National Cyber Warfare Foundation (NCWF)

FIN6

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.

Alternate names
Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest, ATK
88, ATK88, Camouflage Tempest, FIN6, G0037, GOLD FRANKLIN, ITG08, MageCart
Group 6, SKELETON SPIDER, TA4557, TAAL, TAG-CR2, White Giant,

FIN6 is an advanced persistent threat (APT) that has been active since at least 2013 and continues to target financial institutions, government agencies, and other organizations worldwide. It uses a variety of tactics such as spear-phishing emails, malware injections, and social engineering techniques to gain access to sensitive information and steal money from victims\' accounts. FIN6 is also known for its sophisticated infrastructure that includes multiple command and control servers located around the world, making it difficult to track down and stop. The group has been linked to several high-profile attacks in recent years, including the 2018 cyberattack on Russian bank Sberbank.

Techniques, tactics and practices:

FIN6 uses a variety of tactics such as spear-phishing emails, malware injections, and social engineering techniques to gain access to sensitive information. They also use sophisticated infrastructure that includes multiple command and control servers located around the world, making it difficult to track down and stop them. Additionally, they have been known to target financial institutions, government agencies, and other organizations worldwide in order to steal money from victims\' accounts.

FIN is a group targeting financial
assets including assets able to do financial transaction including PoS. FIN6 is
a cybercrime group that has stolen payment card data and sold it for profit on
underground marketplaces. This group has aggressively targeted and compromised
point of sale (PoS) systems in the hospitality and retail sectors. (FireEye)
FIN6 is a cybercriminal group intent on stealing payment card data for
monetization. In 2015, FireEye Threat Intelligence supported several Mandiant
Consulting investigations in the hospitality and retail sectors where FIN6
actors had aggressively targeted and compromised point-of-sale (POS) systems,
making off with millions of payment card numbers. Through iSIGHT, we learned
that the payment card numbers stolen by FIN6 were sold on a “card shop” — an
underground criminal marketplace used to sell or exchange payment card data.

First seen

2015

Target categories

Chemical, Energy, Hospitality, Manufacturing, Retail,

Tools

TTP

T1134

[FIN6] has used has used Metasploit’s named-pipe impersonation technique to
escalate privileges.(Citation: FireEye FIN6 Apr 2019)

T1087

T1087.002

[FIN6] has used Metasploit’s [PsExec](https://attack.mitre.org/software/S0029)
NTDSGRAB module to obtain a copy of the victim\'s Active Directory
database.(Citation: FireEye FIN6 April 2016)

T1560

Following data collection, [FIN6] has compressed log files into a ZIP archive
prior to staging and exfiltration.(Citation: FireEye FIN6 April 2016)

T1560.003

[FIN6] has encoded data gathered from the victim with a simple substitution
cipher and single-byte XOR using the 0xAA key, and Base64 with character
permutation.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6
October 2019)

T1119

[FIN6] has used a script to iterate through a list of compromised PoS systems,
copy and remove data to a log file, and to bind to events from the submit
payment button.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6
October 2019)

T1547

T1547.001

[FIN6] has used Registry Run keys to establish persistence for its downloader
tools known as HARDTACK and SHIPBREAD.(Citation: FireEye FIN6 April 2016)

T1110

T1110.002

[FIN6] has extracted password hashes from ntds.dit to crack offline.(Citation:
FireEye FIN6 April 2016)

T1059

[FIN6] has used scripting to iterate through a list of compromised PoS systems,
copy data to a log file, and remove the original data files.(Citation: FireEye
FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

T1059.001

[FIN6] has used PowerShell to gain access to merchant\'s networks, and a
Metasploit PowerShell module to download and execute shellcode and to set up a
local listener.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr
2019)(Citation: Visa FIN6 Feb 2019)

T1059.003

[FIN6] has used kill.bat script to disable security tools.(Citation: FireEye
FIN6 Apr 2019)

T1059.007

[FIN6] has used malicious JavaScript to steal payment card data from e-commerce
sites.(Citation: Trend Micro FIN6 October 2019)

T1555

[FIN6] has used the Stealer One credential stealer to target e-mail and file
transfer utilities including FTP.(Citation: Visa FIN6 Feb 2019)

T1555.003

[FIN6] has used the Stealer One credential stealer to target web
browsers.(Citation: Visa FIN6 Feb 2019)

T1213

[FIN6] has collected schemas and user accounts from systems running SQL
Server.(Citation: Visa FIN6 Feb 2019)

T1005

[FIN6] has collected and exfiltrated payment card data from compromised
systems.(Citation: Trend Micro FIN6 October 2019)(Citation: RiskIQ British
Airways September 2018)(Citation: RiskIQ Newegg September 2018)

T1074

T1074.002

[FIN6] actors have compressed data from remote systems and moved it to another
staging system before exfiltration.(Citation: FireEye FIN6 April 2016)

T1573

T1573.002

[FIN6] used the Plink command-line utility to create SSH tunnels to C2
servers.(Citation: FireEye FIN6 April 2016)

T1048

T1048.003

[FIN6] has sent stolen payment card data to remote servers via HTTP
POSTs.(Citation: Trend Micro FIN6 October 2019)

T1068

[FIN6] has used tools to exploit Windows vulnerabilities in order to escalate
privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398,
all of which could allow local users to access kernel-level
privileges.(Citation: FireEye FIN6 April 2016)

T1562

T1562.001

[FIN6] has deployed a utility script named kill.bat to disable
anti-virus.(Citation: FireEye FIN6 Apr 2019)

T1070

T1070.004

[FIN6] has removed files from victim machines.(Citation: FireEye FIN6 April
2016)

T1036

T1036.004

[FIN6] has renamed the \"psexec\" service name to \"mstdc\" to
masquerade as a legitimate Windows service.(Citation: FireEye FIN6 Apr 2019)

T1046

[FIN6] used publicly available tools (including Microsoft\'s built-in SQL
querying tool, osql.exe) to map the internal network and conduct reconnaissance
against Active Directory, Structured Query Language (SQL) servers, and
NetBIOS.(Citation: FireEye FIN6 April 2016)

T1095

[FIN6] has used Metasploit Bind and Reverse TCP stagers.(Citation: Trend Micro
FIN6 October 2019)

T1027

T1027.010

[FIN6] has used encoded PowerShell commands.(Citation: Visa FIN6 Feb 2019)

T1588

T1588.002

[FIN6] has obtained and used tools such as
[Mimikatz](https://attack.mitre.org/software/S0002), [Cobalt
Strike](https://attack.mitre.org/software/S0154), and
[AdFind](https://attack.mitre.org/software/S0552).(Citation: Security
Intelligence More Eggs Aug 2019)(Citation: FireEye FIN6 Apr 2019)

T1003

T1003.001

[FIN6] has used [Windows Credential
Editor](https://attack.mitre.org/software/S0005) for credential
dumping.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

T1003.003

[FIN6] has used Metasploit’s [PsExec](https://attack.mitre.org/software/S0029)
NTDSGRAB module to obtain a copy of the victim\'s Active Directory
database.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

T1566

T1566.001

[FIN6] has targeted victims with e-mails containing malicious
attachments.(Citation: Visa FIN6 Feb 2019)

T1566.003

[FIN6] has used fake job advertisements sent via LinkedIn to spearphish
targets.(Citation: Security Intelligence More Eggs Aug 2019)

T1572

[FIN6] used the Plink command-line utility to create SSH tunnels to C2
servers.(Citation: FireEye FIN6 April 2016)

T1021

T1021.001

[FIN6] used RDP to move laterally in victim networks.(Citation: FireEye FIN6
April 2016)(Citation: FireEye FIN6 Apr 2019)

T1018

[FIN6] used publicly available tools (including Microsoft\'s built-in SQL
querying tool, osql.exe) to map the internal network and conduct reconnaissance
against Active Directory, Structured Query Language (SQL) servers, and
NetBIOS.(Citation: FireEye FIN6 April 2016)

T1053

T1053.005

[FIN6] has used scheduled tasks to establish persistence for various malware it
uses, including downloaders known as HARDTACK and SHIPBREAD and
[FrameworkPOS](https://attack.mitre.org/software/S0503).(Citation: FireEye FIN6
April 2016)

T1553

T1553.002

[FIN6] has used Comodo code-signing certificates.(Citation: Security
Intelligence More Eggs Aug 2019)

T1569

T1569.002

[FIN6] has created Windows services to execute encoded PowerShell
commands.(Citation: FireEye FIN6 Apr 2019)

T1204

T1204.002

[FIN6] has used malicious documents to lure victims into allowing execution of
PowerShell scripts.(Citation: Visa FIN6 Feb 2019)

T1078

To move laterally on a victim network, [FIN6] has used credentials stolen from
various systems on which it gathered usernames and password hashes.(Citation:
FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)(Citation: Visa FIN6
Feb 2019)

T1102

[FIN6] has used Pastebin and Google Storage to host content for their
operations.(Citation: FireEye FIN6 Apr 2019)

T1047

[FIN6] has used WMI to automate the remote execution of PowerShell
scripts.(Citation: Security Intelligence More Eggs Aug 2019)

Alternate Group Names
ATK88, Camouflage Tempest, G0037, GOLD FRANKLIN, ITG08, MageCart Group 6, SKELETON SPIDER, White Giant,

FIN6

FIN6

Comments