FIN6 (G0037) | Threat Actor Index

About FIN6

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.

View MITRE record ↗

Techniques by Tactic (40)

Resource Development

T1588.002 Tool

Initial Access

T1078 Valid AccountsT1566.001 Spearphishing AttachmentT1566.003 Spearphishing via Service

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.007 JavaScriptT1204.002 Malicious FileT1569.002 Service Execution

Persistence

T1053.005 Scheduled TaskT1078 Valid AccountsT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled TaskT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1134 Access Token ManipulationT1547.001 Registry Run Keys / Startup Folder

Stealth

T1027.010 Command ObfuscationT1036.004 Masquerade Task or ServiceT1070.004 File DeletionT1078 Valid AccountsT1134 Access Token Manipulation

Defence Impairment

T1553.002 Code SigningT1685 Disable or Modify Tools

Credential Access

T1003.001 LSASS MemoryT1003.003 NTDST1110.002 Password CrackingT1555 Credentials from Password StoresT1555.003 Credentials from Web Browsers

Discovery

T1018 Remote System DiscoveryT1046 Network Service DiscoveryT1087.002 Domain Account

Lateral Movement

T1021.001 Remote Desktop Protocol

Collection

T1005 Data from Local SystemT1074.002 Remote Data StagingT1119 Automated CollectionT1213.006 DatabasesT1560 Archive Collected DataT1560.003 Archive via Custom Method

Command & Control

T1095 Non-Application Layer ProtocolT1102 Web ServiceT1572 Protocol TunnelingT1573.002 Asymmetric Cryptography

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Toolsets (12)

🐛

Cobalt Strike S0154

Malware · Linux, macOS, Windows

🐛

FlawedAmmyy S0381

Malware · Windows

🐛

FrameworkPOS S0503

Malware

🐛

GrimAgent S0632

Malware · Windows

🐛

LockerGoga S0372

Malware · Windows

🐛

Maze S0449

Malware · Windows

🐛

More_eggs S0284

Malware · Windows

🐛

Ryuk S0446

Malware · Windows

🔧

AdFind S0552

Tool · Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

PsExec S0029

Tool · Windows

🔧

Windows Credential Editor S0005

Tool · Windows

References & Reports (6)