FIN13__2022__FIN13_A_Cybercriminal_Threat_Actor_Focused_on_Mexico_Mandiant.pdf

FIN13 is a financially motivated cybercriminal actor tracked by Mandiant since ~2016 that exclusively targets Mexican entities (notably financial, retail, and hospitality). The actor favors long, stealthy intrusions using passive backdoors and web shells (e.g., BLUEAGAVE, SWEARJAR, SIXPACK, JSPRAT), performs extensive reconnaissance and credential theft, moves laterally with native tooling and custom utilities, and exfiltrates POS/ATM and treasury data to facilitate fraudulent ISO 8583 transactions; the report includes malware descriptions, MITRE ATT&CK mappings, IOCs, and recommended validation actions.