MITRE ATT&CKgroup

G0037 FIN6

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics
Aliases
Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest
Version
4.0
Created
2017-05-31

Description

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.

Related

Uses · MITRE ATT&CK (52)

  • T1685 Disable or Modify Tools technique
  • T1213.006 Databases sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • S0632 GrimAgent software (malware)
  • S0552 AdFind software (tool)
  • T1588.002 Tool sub-technique
  • S0503 FrameworkPOS software (malware)
  • T1059.007 JavaScript sub-technique
  • S0449 Maze software (malware)
  • S0446 Ryuk software (malware)
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1572 Protocol Tunneling technique
  • T1074.002 Remote Data Staging sub-technique
  • T1204.002 Malicious File sub-technique
  • T1569.002 Service Execution sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.003 Spearphishing via Service sub-technique
  • T1087.002 Domain Account sub-technique
  • T1560 Archive Collected Data technique
  • T1560.003 Archive via Custom Method sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1003.003 NTDS sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1110.002 Password Cracking sub-technique
  • T1555 Credentials from Password Stores technique
  • T1036.004 Masquerade Task or Service sub-technique
Show all 52 ›

References