APT
ATLAS
Atlas
Actors
147
Names
471
Sectors
40
Requirements
480
⌘K
▸
sign in
Atlas
Actors
147
Names
471
Sectors
40
Requirements
480
LOADING
FIN13 (aka Elephant Beetle) · APT Atlas
Actors
/
Cybercrime
/
Unattributed
FIN13
CRIME
?? · Unattributed
AKA
Elephant Beetle
CrowdStrike
:
SARDONIC BEETLE
Targets
4
Sectors
2
Threat types
1
GIRs covered
0/480
Active since
2013
Pin to atlas
Watch
Share
Export
Also tracked as
2 vendor names · 1 other aliases
Open Rosetta Stone
CrowdStrike
SARDONIC BEETLE
Mandiant
FIN13
UNATTRIBUTED ALIASES
Elephant Beetle
Victimology
Geographic footprint · 4 countries
Region filter
Export
origin · unattributed
targeted countries · 4
AMERICAS ·
3
Canada
·
Mexico
·
United States
EUROPE ·
1
Spain
Sectors targeted
2 of 40
Financial Services
74 actors
Retail & Hospitality
33 actors
Tactics, techniques, procedures
Threat types + MITRE ATT&CK mapping
THREAT TYPES
FIN · Financial Fraud
MITRE ATT&CK · 35 techniques
Initial Access
· 1
T1190
Exploit Public-Facing Application
Execution
· 5
T1047
Windows Management Instrumentation
T1053.005
Scheduled Task
T1059.001
PowerShell
T1059.003
Windows Command Shell
T1059.005
Visual Basic
Persistence
· 1
Credential Access
· 4
T1003.001
LSASS Memory
Discovery
· 6
T1016
System Network Configuration Discovery
T1046
Network Service Discovery
Lateral Movement
· 5
T1021.001
Remote Desktop Protocol
T1021.002
Collection
· 2
T1005
Data from Local System
T1560.001
Archive via Utility
Impact
· 2
T1565
Data Manipulation
Command And Control
· 3
T1071.001
Web Protocols
T1090.001
Internal Proxy
Defense Impairment
· 1
T1556
Modify Authentication Process
Stealth
· 5
T1036
Masquerading
T1036.004
Masquerade Task or Service
T1036.005
Match Legitimate Resource Name or Location
GIR coverage
0 / 480 requirements satisfied
Open matrix
No GIRs mapped yet for this actor.
Open data
Machine-readable exports of this profile
JSON · REST
Actor record
Full profile via the public v1 API
STIX 2.1
Intrusion-set bundle
Deterministic ids · techniques + targeted countries
ATT&CK NAVIGATOR
Technique layer
35 techniques · layer format 4.5
Related actors
By origin and actor type
FIN10
cybercrime
unattributed · 1 targets · since 2013
FIN2
cybercrime
unattributed · 0 targets · since —
FIN6
cybercrime
Russia · 15 targets · since 2014
APT73
nation-state
unattributed · 0 targets · since —
UNC1543
cybercrime
unattributed · 22 targets · since —
FIN3
cybercrime
unattributed · 1 targets · since —
T1547.001
Registry Run Keys / Startup Folder
T1003.002
Security Account Manager
T1003.003
NTDS
T1552.001
Credentials In Files
T1049
System Network Connections Discovery
T1083
File and Directory Discovery
T1087
Account Discovery
T1135
Network Share Discovery
SMB/Windows Admin Shares
T1021.004
SSH
T1021.006
Windows Remote Management
T1550.002
Pass the Hash
T1657
Financial Theft
T1105
Ingress Tool Transfer
T1140
Deobfuscate/Decode Files or Information
T1564.001
Hidden Files and Directories