FIN6

Techniques (MITRE ATT&CK)40

SourceMITRE ATT&CK

Also known as:Magecart Group 6ITG08Skeleton SpiderTAALCamouflage Tempest

Vexday analysis

FIN6 (também referenciado como Magecart Group 6, ITG08, Skeleton Spider, TAAL e Camouflage Tempest) é um grupo cibercriminoso especializado no roubo de dados de cartões de pagamento para revenda em mercados clandestinos. O grupo tem como alvos prioritários sistemas de ponto de venda (PoS) nos setores de hospitalidade e varejo, conduzindo comprometimentos de forma agressiva e sistemática. Ao grupo são atribuídas 40 técnicas documentadas no MITRE ATT&CK (identificador G0037) e a exploração de 3 CVEs conhecidas.

Techniques (MITRE ATT&CK) 40

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Tool

Initial access

Spearphishing Attachment Spearphishing via Service

Execution

Windows Management Instrumentation Scheduled Task Command and Scripting Interpreter PowerShell Windows Command Shell JavaScript Malicious File Service Execution

Persistence

Registry Run Keys / Startup Folder

Privilege escalation

Exploitation for Privilege Escalation

Credential access

LSASS Memory NTDS Password Cracking Credentials from Password Stores Credentials from Web Browsers

Discovery

Remote System Discovery Network Service Discovery Domain Account

Lateral movement

Remote Desktop Protocol

Collection

Data from Local System Remote Data Staging Automated Collection Databases Archive Collected Data Archive via Custom Method

Command and control

Non-Application Layer Protocol Web Service Protocol Tunneling Asymmetric Cryptography

Exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

defense-impairment

Code Signing Disable or Modify Tools

stealth

Command Obfuscation Masquerade Task or Service File Deletion Valid Accounts Access Token Manipulation

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2013-3660HIGHEPSS 40%KEV CVE-2011-2005HIGHEPSS 32%KEV CVE-2010-4398HIGHEPSS 9%KEV

FIN6 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →