FIN9
FIN9 is a Vietnam-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets organisations in the United States. It uses 2 MITRE ATT&CK techniques.
- Origin
- Vietnam
- Techniques
- 2
- Exploited CVEs
- No CVE data
- First seen
- May 1, 2018
- Last seen
- Oct 31, 2021
- Record updated
Who They Target.
About FIN9.
FIN9 is an international cybercrime group whose charged members are Vietnamese nationals. According to the US Department of Justice indictment unsealed on 24 June 2024 (District of New Jersey), from at least May 2018 through October 2021 the group intruded into the networks of companies across the United States, causing more than USD 71 million in losses. Initial access relied on phishing campaigns and supply-chain compromises of third-party vendors. Inside victim networks the actors stole non-public information and employee benefits, and in one case accessed an employee recognition system to issue roughly 7,617 fraudulent gift cards worth about USD 1 million to accounts they controlled; proceeds were laundered through cryptocurrency. Four defendants (Ta Van Tai, Nguyen Viet Quoc, Nguyen Trang Xuyen, Nguyen Van Truong) were charged with conspiracy, wire fraud, computer damage, money laundering and identity theft.
Last updated Oct 14, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.