FIN6 (Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest)

Overview

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.

Capabilities

Custom malware/implant development — ATT&CK: 8 attributed custom malware families

TTPs — 40 techniques across 13 tactics

Resource Development

T1588.002 Tool

Stealth

Defense Impairment

T1553.002 Code Signing
T1685 Disable or Modify Tools

Credential Access

T1003.001 LSASS Memory
T1003.003 NTDS
T1110.002 Password Cracking
T1555 Credentials from Password Stores
T1555.003 Credentials from Web Browsers

Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol

Collection

Command and Control

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Tools & malware (12)

FlawedAmmyy · GrimAgent · FrameworkPOS · More_eggs · Cobalt Strike · Windows Credential Editor · AdFind · PsExec · Maze · LockerGoga · Ryuk · Mimikatz

Reporting (3)

How Microsoft names threat actors — Microsoft
ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework — Villadsen, O
More_eggs, Anyone? Threat Actor ITG08 Strikes Again — Villadsen, O.