FORENSIA

THREAT_ACTOR · G0051

FIN10

Also known as: FIN10

Profile

FIN10 is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. The group uses stolen data exfiltrated from victims to extort organizations.

MITRE ATT&CK ↗

Techniques

11 ATT&CK techniques attributed to this actor.

T1021.001 Remote Desktop ProtocolT1033 System Owner/User DiscoveryT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1070.004 File DeletionT1078 Valid AccountsT1078.003 Local AccountsT1547.001 Registry Run Keys / Startup FolderT1570 Lateral Tool TransferT1588.002 Tool

Software

1 malware/tools attributed to this actor.

Empire

Related corpus activity

9,099 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to FIN10.

IndicatorTypeFamilySevSrc
cve-2021-29441cve—851
cve-2025-12057cve—851
cve-2024-1781cve—851
cve-2026-4368cveransomware851
cve-2025-7852cve—851
cve-2025-34085cve—851
cve-2025-0921cve—852
cve-2025-68670cve—852
cve-2023-44976cveransomware852
cve-2025-2492cve—852
cve-2026-3844cve—851
cve-2025-7443cve—851
cve-2016-0638cvephishing851
cve-2017-17215cve—852
cve-2025-23304cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2021-27076cve—851
cve-2018-8007cve—851
cve-2026-3102cve—853
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2026-1969cve—851
cve-2026-0740cve—851
44a4ac119349f525d877728b53fe38453a516881d577679caf08ab69312a695fsha256phishing802
2654c08491a0f7c4a3dfc6282de5638bhash—803
625b6535321d58bb5c613e85332bf731hash—803
50ebf107d522326c9a9db8821fe3263aa5136964faaf5dd183657bbb52725f84sha256phishing802
248ded4723e9f5da793e5e42d1ba7c2293dd704718f149b84b3b9b818a1f51dbsha256phishing802
5115277eabf2d22d49dcef1e155874387d8e783853bd86debf7ff58588aae35dsha256phishing802

Showing the top 30 by severity of 9,099.