FIN6 - G0037

Created: 2017-05-31T21:32:06.015Z

Modified: 2023-03-22T03:50:17.471Z

Contributors: Center for Threat-Informed Defense (CTID),Drew Church, Splunk

Aliases

FIN6,Magecart Group 6,ITG08,Skeleton Spider

Description

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

Techniques Used

FIN6 has obtained and used tools such as

Mimikatz,

Cobalt Strike, and

AdFind.(Citation: Security Intelligence More Eggs Aug 2019)(Citation: FireEye FIN6 Apr 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|

FIN6 has used

FIN6 has used Metasploit Bind and Reverse TCP stagers.(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

FIN6 has collected schemas and user accounts from systems running SQL Server.(Citation: Visa FIN6 Feb 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|

FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.007|JavaScript|

FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|