FIN6

Threat Actors · FIN6

· ATT&CK GroupG0037

Magecart Group 6ITG08Skeleton SpiderTAALCamouflage Tempest

Techniques

Software

Tactics

Aliases

Description

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

Tactic Coverage

execution (8)collection (6)credential access (5)stealth (5)privilege escalation (5)command and control (4)discovery (3)persistence (3)initial access (3)defense impairment (2)lateral movement (1)exfiltration (1)resource development (1)

Techniques Used (40)

T1003.001LSASS Memory

credential access

T1003.003NTDS

credential access

T1005Data from Local System

collection

T1018Remote System Discovery

discovery

T1021.001Remote Desktop Protocol

lateral movement

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 40 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (12)

S0552AdFindtool S0154Cobalt Strikemalware S0381FlawedAmmyymalware S0503FrameworkPOSmalware S0632GrimAgentmalware S0372LockerGogamalware S0449Mazemalware S0002Mimikatz

References (13)

https://attack.mitre.org/groups/G0037 https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/