THREAT_ACTOR · G0053
FIN5
Also known as: FIN5
Profile
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.
MITRE ATT&CK ↗Techniques
11 ATT&CK techniques attributed to this actor.
Software
6 malware/tools attributed to this actor.
Windows Credential EditorpwdumpPsExecRawPOSFLIPSIDESDelete
Related corpus activity
7,913 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to FIN5.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2016-0638 | cve | phishing | 85 | 1 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2025-34085 | cve | — | 85 | 1 |
| cve-2017-17215 | cve | — | 85 | 2 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2026-0740 | cve | — | 85 | 1 |
| cve-2025-12057 | cve | — | 85 | 1 |
| cve-2025-61155 | cve | ransomware | 85 | 3 |
| cve-2025-1055 | cve | ransomware | 85 | 3 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2026-3844 | cve | — | 85 | 1 |
| cve-2025-7443 | cve | — | 85 | 1 |
| cve-2025-7852 | cve | — | 85 | 1 |
| cve-2023-52271 | cve | ransomware | 85 | 3 |
| cve-2021-27137 | cve | — | 85 | 8 |
Showing the top 30 by severity of 7,913.