FireEye has dubbed the cybercrime gang FIN5. One of the most unique things about FIN5 is that in every intrusion we responded to where FIN5 has been active, legitimate access was identified. They had valid user credentials to remotely log into the network," said Barry Vengerik, principal threat analyst at FireEye. No sexy zero-days, no remote exploits -- not even spearphishing