FIN13__2022__Sygnia-_Elephant_Beetle_Jan2022.pdf

Sygnia details a multi-year, organized financial-theft operation named "Elephant Beetle" that targets primarily Latin American financial and commerce organizations by exploiting vulnerable Java-based web applications (WebSphere/WebLogic/SAP) to deploy web shells and malicious WARs, perform long-term reconnaissance, harvest credentials, move laterally (via SQL xp_cmdshell, WMI, SMB), and inject fraudulent transactions to siphon incremental funds; the report includes CVEs used, extensive tool and file hashes, YARA rules, MITRE ATT&CK mappings, and defensive recommendations.