From 309428325257aab011f0444f175bfcefadc93bd5 Mon Sep 17 00:00:00 2001
From: Daniel Plohmann <daniel.plohmann@mailbox.org>
Date: Mon, 3 Jan 2022 09:32:43 +0100
Subject: [PATCH] adding Mandiant's FIN13.

---
 clusters/threat-actor.json | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index e4eb11c7..0619d582 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -8873,7 +8873,17 @@
       },
       "uuid": "da581c60-7c3d-4de6-b54c-cafea1c58389",
       "value": "Common Raven"
+    },
+    {
+      "description": "Since 2017, Mandiant has been tracking FIN13, an industrious and versatile financially motivated threat actor conducting long-term intrusions in Mexico with an activity timeframe stretching back as early as 2016. Although their operations continue through the present day, in many ways FIN13's intrusions are like a time capsule of traditional financial cybercrime from days past. Instead of today's prevalent smash-and-grab ransomware groups, FIN13 takes their time to gather information to perform fraudulent money transfers. Rather than relying heavily on attack frameworks such as Cobalt Strike, the majority of FIN13 intrusions involve heavy use of custom passive backdoors and tools to lurk in environments for the long haul.",
+      "meta": {
+        "refs": [
+          "https://www.mandiant.com/resources/fin13-cybercriminal-mexico"
+        ]
+      },
+      "uuid": "60fa684d-c738-4b77-98fb-3f6605e2bb82",
+      "value": "FIN13"
     }
   ],
-  "version": 207
+  "version": 208
 }