FIN11 is a financially motivated group that moved from mass phishing to mass exploitation of file transfer and business applications, then extorted victims through the CL0P leak site. For defenders the group matters less for its malware than for its pattern: steal data quickly from an internet-facing system, wait weeks, then pressure executives by email and leak site. This profile covers what Mandiant and Google Threat Intelligence Group (GTIG) have published about FIN11 and its suspected clusters, how attribution has shifted, and the detection, hardening and response steps that break the pattern. It is written for threat intelligence analysts, SOC leads and owners of file transfer and ERP platforms. It goes deeper on FIN11 itself than the Cl0p Threat Actor Profile, which covers the extortion brand.
Key takeaways
- FIN11 is a Mandiant name, not a synonym for TA505 or CL0P. Mandiant says Proofpoint's TA505 covers a subset of FIN11 activity and warns against using the names interchangeably; CL0P is a ransomware family and leak site brand that FIN11 has used.
- The playbook changed in 2020. Mandiant reported FIN11 moved from point-of-sale malware (2018) to CLOP ransomware (2019) to hybrid extortion with published stolen data (2020).
- Managed file transfer is the recurring target. Accellion FTA, GoAnywhere MFT, MOVEit Transfer and Cleo products were all hit in mass zero-day campaigns that GTIG links to the CL0P brand, with differing attribution confidence per campaign.
- Theft is fast, extortion is slow. In MOVEit Mandiant saw files stolen within minutes of web shell deployment, while extortion email in earlier FIN11 cases followed several weeks after the theft, which gives defenders a window to scope and notify.
- Attribution is often "overlap", not proof. GTIG has not formally attributed the 2025 Oracle E-Business Suite campaign; it cites tooling similarity, the CL0P brand and a sender account previously used by FIN11.
Who FIN11 is and how the names fit together
Mandiant promoted FIN11 to a named financially motivated group in October 2020, describing it as active since at least 2016 and notable for volume rather than sophistication. Its early campaigns were high-volume phishing: when active the group ran up to five campaigns a week, with long quiet gaps. Mandiant reported that FIN11 casts a wide net and then selects victims for further exploitation based on sector, geography or perceived security posture, and that it relies on criminal service providers for anonymous domain registration, bulletproof hosting, code signing certificates and private or semi-private malware.
Different vendors track overlapping activity under different names, and the overlaps are partial. Read the Threat Actor Naming Conventions Guide before merging intelligence feeds.
| Name | Who uses it | What it describes | Relationship to FIN11 as published |
|---|---|---|---|
| FIN11 | Mandiant, GTIG | Financially motivated group active since at least 2016 | The group itself |
| TA505 (ATT&CK G0092) | Proofpoint; MITRE ATT&CK; CISA and FBI in advisory AA23-158A | Long-running financially motivated actor | Mandiant: TA505 covers a subset of FIN11 activity; early TA505 operations are not attributed to FIN11 |
| CL0P / Clop (ATT&CK S0611) | Most vendors and agencies | Ransomware family and the CL0P^_- LEAKS data leak site, established 2020 | FIN11 deployed CLOP from 2019; GTIG notes at least one other actor using the leak site with different techniques |
| UNC2582, UNC2546 | Mandiant | Accellion FTA extortion and exploitation clusters (2020 to 2021) | UNC2582 overlaps with FIN11; UNC2546 overlaps only weakly; not attributed |
| UNC4857 | Mandiant | MOVEit Transfer exploitation cluster (2023) | Merged into FIN11 on 6 June 2023 |
| UNC5936 | GTIG | Cleo exploitation cluster (late 2024) | Suspected FIN11 cluster |
MITRE ATT&CK does not hold a separate group entry for FIN11, so map behaviour through the techniques below and treat the TA505 entry as related rather than identical. The TA505 Threat Actor Profile Guide covers the Proofpoint view.
Campaign history
The table lists the campaigns that primary reporting connects to FIN11 or its clusters, with the confidence each source gave. All CVEs listed are in the CISA Known Exploited Vulnerabilities catalogue with known ransomware campaign use.
| Period | Target | CVEs | What happened | Attribution as published |
|---|---|---|---|---|
| 2016 to 2020 | Email users, first financial, retail and hospitality, then most sectors | None (phishing) | High-volume phishing; POS malware, then CLOP ransomware, then data theft plus encryption | FIN11 (Mandiant) |
| Mid-December 2020 to early 2021 | Accellion File Transfer Appliance | CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 | DEWMODE web shell listed and downloaded files; extortion emails from late January 2021 under the CL0P name | UNC2546 and UNC2582, overlaps with FIN11, not attributed (Mandiant) |
| Late January 2023 | Fortra GoAnywhere MFT | CVE-2023-0669 | Mass exploitation of the file transfer platform | Described by Mandiant as prior FIN11 mass file transfer exploitation; CISA and FBI list it as a CL0P campaign |
| From 27 May 2023 | Progress MOVEit Transfer | CVE-2023-34362 | LEMURLOOT web shell, bulk file theft, CL0P leak site claim on 6 June | UNC4857 merged into FIN11 (Mandiant); CL0P, also known as TA505 (CISA and FBI) |
| Late 2024 | Cleo file transfer products | KEV lists CVE-2024-50623 and CVE-2024-55956 for Cleo | GOLDVEIN downloader and GOLDTOMB backdoor deployed | UNC5936, suspected FIN11 (GTIG) |
| From 9 August 2025 | Oracle E-Business Suite | CVE-2025-61882 (later patch for CVE-2025-61884) | Malicious templates and in-memory Java implants; extortion emails to executives from 29 September 2025 | Not formally attributed; overlaps with FIN11 (GTIG) |
The Oracle campaign is written up as the Oracle E-Business Suite Cl0p zero-day breach, which also records a separate vendor assessment of who was involved.
Tactics and techniques
The mapping below is NHI Mgmt Group's reading of the Mandiant and GTIG reporting against ATT&CK v20. It describes behaviour for detection planning, not attacker procedure.
| Stage | Observed behaviour (source) | ATT&CK technique | Defender focus |
|---|---|---|---|
| Resource development | Zero-days in file transfer and ERP products; bought hosting, domains and code signing certificates (Mandiant) | T1588.006 Vulnerabilities; T1583 Acquire Infrastructure | Assume unknown flaws: reduce internet exposure of file transfer and ERP admin paths |
| Initial access | Mass phishing (2016 to 2020); exploitation of internet-facing file transfer and ERP applications (2020 onward) | T1566 Phishing; T1190 Exploit Public-Facing Application | Mail filtering; emergency patching for KEV-listed file transfer flaws |
| Persistence | DEWMODE and LEMURLOOT web shells; MOVEit backdoor user named "Health Check Service" | T1505.003 Web Shell; T1136.001 Local Account | File integrity monitoring of web roots; alert on new application admin accounts |
| Stealth | DEWMODE cleanup removed its entries from Apache logs and deleted itself; Oracle EBS implants ran in memory | T1070.004 File Deletion | Forward logs off the appliance in real time; memory forensics on Java processes |
| Collection and exfiltration | File listings from application databases; LEMURLOOT returned Azure Blob storage settings and keys | T1530 Data from Cloud Storage; T1048 Exfiltration Over Alternative Protocol | Egress filtering from file transfer and ERP servers; volume baselines |
| Impact | CLOP encryption (2019 to 2020); extortion by email and leak site | T1486 Data Encrypted for Impact; T1657 Financial Theft | Offline backups; an extortion response playbook |
How the extortion phase works, from the victim's side
Primary reporting describes a consistent sequence that defenders can plan against.
- Quiet theft. Files are taken soon after access. Mandiant saw MOVEit theft within minutes of web shell deployment and Accellion downloads within hours.
- A gap of weeks. In Accellion the extortion emails began in late January 2021, several weeks after DEWMODE was installed. In MOVEit Mandiant expected contact "in the coming days and/or weeks" based on earlier FIN11 cases.
- Targeted email first. Accellion victims first received emails at a few addresses from free accounts. The 2025 Oracle campaign sent emails to executives from hundreds or thousands of compromised third-party accounts that GTIG assessed were likely sourced from infostealer logs, which helps them pass spam filters.
- Proof and escalation. The Oracle emails included file listings from victim environments. Where victims did not respond in the Accellion campaign, the actor sent mass emails and in one case contacted the victim's partners.
- Leak site publication. Victims appeared on the CL0P leak site. GTIG notes past campaigns waited weeks before posting names.
Handle the email and leak site steps with the Extortion Email Playbook and the Ransomware Data Leak Site Listing Playbook. Validate claims against your own logs before engaging, because file listings can come from an earlier, already contained theft.
Where identity fits
FIN11's file transfer campaigns are data theft campaigns, but several steps run through identities that defenders often forget to review.
- Application accounts created by the attacker: LEMURLOOT created an account named "Health Check Service" or reused an existing high-privilege MOVEit account. Inventory application-level users on file transfer platforms and alert on new admin-level accounts outside change windows. See the MOVEit Transfer Hardening Guide.
- Cloud storage keys held by the platform: LEMURLOOT could return Azure Blob storage account, key and container settings. Treat any storage keys or connector credentials configured in a compromised platform as exposed and rotate them. See the Managed file transfer (MFT) integration security guide.
- Service accounts on the host: Oracle EBS post-exploitation ran under the application operating system account, and GTIG advises reviewing child processes of shells launched by Java as that account.
- Third-party mailboxes: extortion email arrives from real, compromised accounts at unrelated organisations. Sender reputation alone will not catch it, and your own users' infostealer exposure feeds the next campaign. See the Infostealer Logs Monitoring and Response Guide.
Detection and hunting
Work from the published indicators for each campaign, then move to behaviour that survives the next zero-day.
| Signal | Where to look | Why it matters |
|---|---|---|
| New or modified files in the web root of a file transfer server, such as ASPX or PHP files that mimic legitimate names | File integrity monitoring, EDR file events | LEMURLOOT masqueraded as the legitimate human.aspx; DEWMODE was written to about.html |
| POST requests to rarely used pages preceding web shell traffic | Web server and WAF logs forwarded off-host | Mandiant saw POSTs to guestaccess.aspx before LEMURLOOT interaction |
| Gaps or deletions in appliance logs | SIEM log source health, comparing forwarded and local logs | DEWMODE cleanup removed entries and cleared an admin log |
| New application admin accounts | File transfer platform audit logs, database user tables | The MOVEit backdoor user pattern |
| Unusual outbound connections or volume from file transfer and ERP servers | Firewall, proxy and NetFlow | Bulk exfiltration and implant callbacks; GTIG advises restricting outbound access from EBS servers |
| Unexpected templates or Java child processes in Oracle EBS | EBS database (templates created recently with unusual codes), process telemetry | GTIG lists template review and Java-spawned shells as hunting steps |
| Executive-targeted email claiming data theft | Mail gateway, user reports | The first visible sign for victims who missed the intrusion |
Treat published YARA rules and IP lists as hunting starting points. Mandiant states its rules are for hunting and need validation before use in blocking, and IP indicators age quickly.
Metrics that show coverage:
- Time from KEV listing to patch or isolation for file transfer and ERP products (target: days, not the normal cycle).
- Percentage of internet-facing file transfer and ERP hosts with logs forwarded off-host and file integrity monitoring on the web root.
- Percentage of those hosts with default-deny egress.
- Number of storage keys and connector credentials configured in file transfer platforms with a named owner and a tested rotation procedure.
- Time from an extortion email report to confirmed scoping of the claimed data.
Prevention and hardening priorities
- Inventory every file transfer and ERP system exposed to the internet. Include legacy appliances and shadow deployments. CISA and FBI list asset inventory first among AA23-158A mitigations.
- Put these products on an emergency patch track. Each FIN11-linked campaign used a flaw later added to KEV. Use the Emergency Out-of-Band Patching Playbook and retire products near end of life, as Mandiant noted for the Accellion FTA.
- Reduce exposure. Restrict admin interfaces to management networks, put a WAF or reverse proxy in front of public endpoints, and allow only partner IP ranges where the business case allows.
- Restrict egress. File transfer and ERP servers rarely need general internet access. Default-deny outbound blocks implant callbacks and some exfiltration paths.
- Minimise data at rest. Apply retention limits on file transfer platforms so a breach exposes days of files, not years.
- Harden logging. Forward web, application and system logs off the host in real time so on-box cleanup cannot erase the record.
- Keep phishing defences. FIN11's origin is mass phishing; attachment controls and user reporting still apply.
The Managed File Transfer (MFT) Security Guide covers platform hardening in depth.
Response when you may be a victim
- Trigger: a KEV listing or vendor advisory for a product you run, or an extortion email. Do not wait for the email: the theft may already be weeks old.
- Contain: isolate or take the platform offline, apply the vendor fix and the vendor's containment guidance, preserve memory and logs before rebuilding.
- Scope: use the platform's own transfer logs and database to list files accessed in the exposure window; this drives notification.
- Rotate: application accounts, storage keys, partner credentials and database secrets held by the platform.
- Notify and engage: legal, regulators and affected partners as your obligations require; CISA and FBI ask victims to report incidents. Follow the MFT compromise playbook.
Framework mapping
| Defensive need | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ATT&CK mitigation |
|---|---|---|---|
| Know exposed file transfer and ERP assets | ID.AM-01 | RA-5 | n/a |
| Patch or retire vulnerable software | PR.PS-02 | SI-2 | M1051 Update Software |
| Limit exposure and egress | PR.PS-02 | SC-7 | M1037 Filter Network Traffic; M1030 Network Segmentation |
| Monitor for web shells and exfiltration | DE.CM-09, DE.AE-02 | SI-4 | n/a |
| Use threat intelligence on the actor | ID.RA-02 | RA-5 | n/a |
| Coordinate response with third parties | RS.MA-01 | IR-4, IR-7 | n/a |
| Phishing resilience | n/a | n/a | M1017 User Training |
Common failure patterns
- Merging FIN11, TA505 and CL0P into one entity. This blurs confidence levels and can lead to wrong conclusions about who is behind a new campaign; keep the source's own wording.
- Patching without hunting. In every file transfer campaign theft preceded the patch. Applying the fix closes the door but does not tell you what left.
- Trusting logs on the compromised appliance. DEWMODE removed its own log entries; only off-host copies are reliable.
- Forgetting credentials held by the platform. Storage keys and partner credentials stay valid after the web shell is removed.
- Treating the extortion email as the start of the incident. In the Oracle E-Business Suite Cl0p zero-day breach, exploitation began in August and the emails arrived from late September.
Practitioner checklist
- List every internet-facing file transfer and ERP system, including legacy appliances, with an owner.
- Subscribe to KEV and vendor advisories for those products and set an emergency patch target in days.
- Forward web, application and system logs from those hosts off-box in real time.
- Enable file integrity monitoring on web roots and alert on new script files.
- Apply default-deny egress from file transfer and ERP servers.
- Alert on new admin-level application accounts and review them weekly.
- Record every storage key and partner credential held by these platforms, with a rotation procedure.
- Set retention limits on files held on transfer platforms.
- Rehearse the extortion email and leak site playbooks with legal and communications.
- Tag intelligence with the source's exact actor name and confidence level.
Standards and references
- Mandiant: FIN11, Widespread Email Campaigns as Precursor for Ransomware and Data Theft
- Mandiant: Accellion FTA Exploited for Data Theft and Extortion
- Mandiant: Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft
- Google Threat Intelligence Group: Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign
- CISA and FBI: #StopRansomware CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A)
- CISA: Known Exploited Vulnerabilities Catalog
- MITRE ATT&CK: TA505 (G0092)
- MITRE ATT&CK: Clop (S0611)
Related NHI Mgmt Group resources: Cl0p Threat Actor Profile · Threat Actors Targeting Financial Services Guide · Threat Actor Naming Conventions Guide · Data Extortion Without Encryption Guide