A threat actor has been seen undertaking a massive financial-theft operation targeting transaction systems throughout Latin America for the past four (4) years. The threat group, Elephant Beetle, has been linked to the incidents based on intrusions of retail companies and banking organizations where actors injected fraudulent transactions amongst low-risk activity to avoid detection within the system(s). Elephant Beetle threat actors utilize a significantly sized arsenal of weaponized malicious programs, exploits, web shells, and scripts aimed at carrying out their financially motivated operations. After conducting months of reconnaissance on a target, these actors typically exploit public-facing Java-based web servers with are susceptible to CVE-2017-1000486, CVE-2015-7450, CVE-2010-5326, and EDB-ID-24963. Once exploited, attackers tunnel through to the MSSQL server where the malicious payloads are deployed before moving laterally throughout the network. Utilized web shells are disguised in the network as legitimate font, image, and CSS/JS resources which are all packed together within WAR archives. Additional intelligence from security researchers suggests that Elephant Beetle may have significant ties to the financially motivated FIN13 threat group. CTIX will continue to monitor the movements of this threat group and provide updates accordingly.