Threat Actors FIN6

FIN6

G0037 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest, FIN6, White Giant, GOLD FRANKLIN, ATK88, G0037, TA4557, Storm-0538, SQUID COMET

Description

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

AI Analysis

· 1 week ago

Executive Summary

FIN6, also known as Magecart Group 6, is a cybercrime group primarily involved in stealing payment card data by compromising PoS systems in retail and hospitality sectors. Their activities include targeting financial data for sale on dark web marketplaces, using techniques like phishing and malware deployment.

Goals & Targeting

FIN6's primary goal appears to be financial gain through the theft and sale of payment card data. They target sectors with high volumes of transactional data, such as retail and hospitality, due to the lucrative nature of this information. While their geographic focus is not explicitly detailed in all available sources, they are known to operate globally.

Enhanced Description

FIN6 has been actively involved in cyberattacks aimed at extracting sensitive payment card information from PoS systems within the hospitality and retail industries. They employ various tactics including spear-phishing attacks and deploying malicious software such as FrameworkPOS to infiltrate targeted systems. Their operations have resulted in significant data breaches, leading to financial losses and reputational damage for affected businesses. FIN6's activities are part of a broader trend of cybercriminal groups targeting the retail sector, where card data is highly valuable on the black market.

Key Capabilities

PoS malware deployment (e.g., FrameworkPOS)
Spear-phishing campaigns
Use of Cobalt Strike for attacks
Exfiltration of payment card data

MITRE ATT&CK Tactics

Initial Access

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Impact

ATT&CK Techniques

T1053.005: Scheduled Task

T1566.003: Spearphishing via Service

T1204.002: Malicious File

Software / Tooling

FrameworkPOS

Cobalt Strike

Campaigns & Victims

FIN6's campaigns demonstrate a focus on long-term financial gain through data extraction. They have targeted PoS systems in multiple countries, though exact targets beyond sectors are not fully detailed here.

IOC Patterns

Spear-phishing via Service (T1566.003)
Distribution of malicious POS software
Scheduled Task creation to maintain persistence

Recommended Actions

Implement robust endpoint detection and response solutions.
Conduct regular employee training on phishing recognition.
Secure PoS systems with strong access controls.
Monitor networks for suspicious activities.

Suggested Tags

Cybercrime

Financial Fraud

PoS Malware

Confidence Assessment

High confidence in their primary activity and targets. Further details on specific targeting countries and campaigns would enhance this assessment.

ATT&CK Techniques

Collection

6 techniques

T1005

Data from Local System

FIN6 has collected and exfiltrated payment card data from compromised systems.(Citation: Trend Micro FIN6 October 2019)(Citation: RiskIQ British Airways September 2018)(Citation: RiskIQ Newegg September 2018)

T1074.002

Remote Data Staging

FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.(Citation: FireEye FIN6 April 2016)

T1119

Automated Collection

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6 October 2019)

T1213.006

Databases

FIN6 has collected schemas and user accounts from systems running SQL Server.(Citation: Visa FIN6 Feb 2019)

T1560

Archive Collected Data

Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.(Citation: FireEye FIN6 April 2016)

T1560.003

Archive via Custom Method

FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6 October 2019)

Command & Control

4 techniques

T1095

Non-Application Layer Protocol

FIN6 has used Metasploit Bind and Reverse TCP stagers.(Citation: Trend Micro FIN6 October 2019)

T1102

Web Service

FIN6 has used Pastebin and Google Storage to host content for their operations.(Citation: FireEye FIN6 Apr 2019)

T1572

Protocol Tunneling

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.(Citation: FireEye FIN6 April 2016)

T1573.002

Asymmetric Cryptography

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.(Citation: FireEye FIN6 April 2016)

Credential Access

5 techniques

T1003.001

LSASS Memory

FIN6 has used Windows Credential Editor for credential dumping.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

T1003.003

NTDS

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

T1110.002

Password Cracking

FIN6 has extracted password hashes from ntds.dit to crack offline.(Citation: FireEye FIN6 April 2016)

T1555

Credentials from Password Stores

FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.(Citation: Visa FIN6 Feb 2019)

T1555.003

Credentials from Web Browsers

FIN6 has used the Stealer One credential stealer to target web browsers.(Citation: Visa FIN6 Feb 2019)

Defense impairment

2 techniques

T1553.002

Code Signing

FIN6 has used Comodo code-signing certificates.(Citation: Security Intelligence More Eggs Aug 2019)

T1685

Disable or Modify Tools

FIN6 has deployed a utility script named <code>kill.bat</code> to disable anti-virus.(Citation: FireEye FIN6 Apr 2019)

Discovery

3 techniques

T1018

Remote System Discovery

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.(Citation: FireEye FIN6 April 2016)

T1046

Network Service Discovery

T1087.002

Domain Account

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.(Citation: FireEye FIN6 April 2016)

Execution

8 techniques

T1047

Windows Management Instrumentation

FIN6 has used WMI to automate the remote execution of PowerShell scripts.(Citation: Security Intelligence More Eggs Aug 2019)

T1053.005

Scheduled Task

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.(Citation: FireEye FIN6 April 2016)

T1059

Command and Scripting Interpreter

FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

T1059.001

PowerShell

FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)(Citation: Visa FIN6 Feb 2019)

T1059.003

Windows Command Shell

FIN6 has used <code>kill.bat</code> script to disable security tools.(Citation: FireEye FIN6 Apr 2019)

T1059.007

JavaScript

FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.(Citation: Trend Micro FIN6 October 2019)

T1204.002

Malicious File

FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.(Citation: Visa FIN6 Feb 2019)

T1569.002

Service Execution

FIN6 has created Windows services to execute encoded PowerShell commands.(Citation: FireEye FIN6 Apr 2019)

Exfiltration

1 technique

T1048.003

Exfiltration Over Unencrypted Non-C2 Protocol

FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.(Citation: Trend Micro FIN6 October 2019)

Initial Access

2 techniques

T1566.001

Spearphishing Attachment

FIN6 has targeted victims with e-mails containing malicious attachments.(Citation: Visa FIN6 Feb 2019)

T1566.003

Spearphishing via Service

FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.(Citation: Security Intelligence More Eggs Aug 2019)

Lateral Movement

1 technique

T1021.001

Remote Desktop Protocol

FIN6 used RDP to move laterally in victim networks.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

Persistence

1 technique

T1547.001

Registry Run Keys / Startup Folder

FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.(Citation: FireEye FIN6 April 2016)

Privilege Escalation

1 technique

T1068

Exploitation for Privilege Escalation

FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.(Citation: FireEye FIN6 April 2016)

Resource Development

1 technique

T1588.002

Tool

FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.(Citation: Security Intelligence More Eggs Aug 2019)(Citation: FireEye FIN6 Apr 2019)

Stealth

5 techniques

T1027.010

Command Obfuscation

FIN6 has used encoded PowerShell commands.(Citation: Visa FIN6 Feb 2019)

T1036.004

Masquerade Task or Service

FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.(Citation: FireEye FIN6 Apr 2019)

T1070.004

File Deletion

FIN6 has removed files from victim machines.(Citation: FireEye FIN6 April 2016)

T1078

Valid Accounts

To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)(Citation: Visa FIN6 Feb 2019)

T1134

Access Token Manipulation

FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.(Citation: FireEye FIN6 Apr 2019)

Software / Tooling

S0154

Cobalt Strike

Family

(Citation: FireEye FIN6 Apr 2019)

S0154

Cobalt Strike - S0154

Family

(Citation: FireEye FIN6 Apr 2019)

S0381

FlawedAmmyy

Family

(Citation: Visa FIN6 Feb 2019)

S0503

FrameworkPOS

Family

(Citation: SentinelOne FrameworkPOS September 2019)(Citation: Crowdstrike Global Threat Report Feb 2018)(Citation: Visa FIN6 Feb 2019)

S0632

GrimAgent

Family

(Citation: Group IB GrimAgent July 2021)

S0372

LockerGoga

Family

(Citation: FireEye FIN6 Apr 2019)

S0449

Maze

Family

(Citation: FireEye Maze May 2020)

S0284

More_eggs

Family

(Citation: Security Intelligence More Eggs Aug 2019)(Citation: Visa FIN6 Feb 2019)

Ransomware

S0446

Ryuk

Family

(Citation: FireEye FIN6 Apr 2019)

Vawtrak/Neverquest

Campaigns / Victims

No campaigns linked yet.

Observed Data

No observed data linked yet.

Indicators of Compromise

View all →

URL 3 Domain 1

URL 3

https://fju-9v4nd-k0atx4-6fx-cctaal.pages.dev/

80% TLP:CLEAR

https://volusion-cdn.com/analytics/beacon

70% TLP:CLEAR

https://storage.googleapis.com/volusionapi/resources.js

70% TLP:CLEAR

Domain 1

volusion-cdn.com

70% TLP:CLEAR

Open in full Indicators list →

References

Crowdstrike Global Threat Report Feb 2018 — CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.
FireEye FIN6 April 2016 — FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.
FireEye FIN6 Apr 2019 — McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.
Microsoft Threat Actor Naming July 2023 — Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Security Intelligence ITG08 April 2020 — Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020.
Security Intelligence More Eggs Aug 2019 — Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

Intel Summary

Techniques

Tools

Campaigns

IOCs

Observed Data

Tactics

Details

MITRE ID: G0037
Type: Unknown
Resource Level: Unknown
Primary Motivation: Espionage
Confidence: 90%
Added: May 2, 2026
STIX ID: intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.