NetWitness Platform Evolved SIEM Solution Brief

NetWitness Incident Response analyzed two FIN13 ("Elephant Beetle") campaigns targeting banks in Latin America in 2021–2022. Attackers exploited public web app vulnerabilities (notably WebLogic deserialization and Log4j), deployed webshells and custom backdoors (PowerShell/Perl/Java), harvested credentials and SecurID token information (including seeds), moved laterally to domain controllers and database servers, exfiltrated authentication artifacts, and committed large-scale online banking fraud impacting many hundreds to ~1,350 customer accounts.