ATT&CKSoftwareFLIPSIDE

FLIPSIDE

S0173

Malware.View on attack.mitre.org

About this malware

FLIPSIDE is a simple tool similar to Plink that is used by FIN5 to maintain access to victims.

Techniques used1

Command and Control1

T1572Protocol Tunneling

Procedure examples1

TechniqueProcedure example
T1572
Protocol Tunneling

FLIPSIDE uses RDP to tunnel traffic from a victim environment.

Mandiant FIN5 GrrCON Oct 2016

Groups that use it1

FIN5

Campaigns0

None recorded.

References1

  1. Mandiant FIN5 GrrCON Oct 2016 Open source
    Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.

© 2026 DetectionCode Website. All Rights Reserved.

Developed by Taher Gabr · LinkedIn