FIN6

APT / StateG0037 ↗
Techniques (MITRE ATT&CK)40
SourceMITRE ATT&CK
0
Also known as:ATK88Camouflage TempestG0037GOLD FRANKLINITG08MageCart Group 6Magecart Group 6SKELETON SPIDERSQUID COMETSkeleton SpiderStorm-0538TA4557TAALWhite Giant

Vexday analysis

FIN6 (também referenciado como Magecart Group 6, ITG08, Skeleton Spider, TAAL e Camouflage Tempest) é um grupo cibercriminoso especializado no roubo de dados de cartões de pagamento para revenda em mercados clandestinos. O grupo tem como alvos prioritários sistemas de ponto de venda (PoS) nos setores de hospitalidade e varejo, conduzindo comprometimentos de forma agressiva e sistemática. Ao grupo são atribuídas 40 técnicas documentadas no MITRE ATT&CK (identificador G0037) e a exploração de 3 CVEs conhecidas.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity65
Impact: High
T1566.001T1047T1547.001T1068T1021.001T1005ENTRYInitial accessSpearphishingAttachmentEXECExecutionWindows ManagementInstrumentationPERSPersistenceRegistry Run Keys/ Startup FolderPRIVPrivilege escalationExploitation forPrivilege Escalat…LATLateral movementRemote DesktopProtocolCOLLCollectionData from LocalSystemEXFILExfiltrationExfiltration OverUnencrypted Non-C…

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 40

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development
Tool
Initial access
Spearphishing AttachmentSpearphishing via Service
Execution
Windows Management InstrumentationScheduled TaskCommand and Scripting InterpreterPowerShellWindows Command ShellJavaScriptMalicious FileService Execution
Persistence
Registry Run Keys / Startup Folder
Privilege escalation
Exploitation for Privilege Escalation
Credential access
LSASS MemoryNTDSPassword CrackingCredentials from Password StoresCredentials from Web Browsers
Discovery
Remote System DiscoveryNetwork Service DiscoveryDomain Account
Lateral movement
Remote Desktop Protocol
Collection
Data from Local SystemRemote Data StagingAutomated CollectionDatabasesArchive Collected DataArchive via Custom Method
Command and control
Non-Application Layer ProtocolWeb ServiceProtocol TunnelingAsymmetric Cryptography
Exfiltration
Exfiltration Over Unencrypted Non-C2 Protocol
defense-impairment
Code SigningDisable or Modify Tools
stealth
Command ObfuscationMasquerade Task or ServiceFile DeletionValid AccountsAccess Token Manipulation

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2013-3660HIGHEPSS 39%KEV MITRE ATT&CK
CVE-2011-2005HIGHEPSS 32%KEV MITRE ATT&CK
CVE-2010-4398HIGHEPSS 9%KEV MITRE ATT&CK

Known infrastructure 2941

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port144.172.68.200:80Cobalt Strikethreatfox
ip:port144.172.68.200:8080Cobalt Strikethreatfox
ip:port153.80.242.105:2080Cobalt Strikethreatfox
ip:port153.80.242.105:2096Cobalt Strikethreatfox
ip:port144.172.68.200:443Cobalt Strikethreatfox
domainagent.cloudfiledisk.comCobalt Strikethreatfox
ip:port156.254.20.47:5998Cobalt Strikethreatfox
ip:port153.80.242.105:8443Cobalt Strikethreatfox
ip:port153.80.242.105:143Cobalt Strikethreatfox
ip:port153.80.242.105:8081Cobalt Strikethreatfox
ip:port95.102.34.46:9090Cobalt Strikethreatfox
ip:port191.124.5.229:8080Cobalt Strikethreatfox
ip:port191.124.5.50:443Cobalt Strikethreatfox
ip:port191.124.5.50:8080Cobalt Strikethreatfox
ip:port191.124.5.50:80Cobalt Strikethreatfox
ip:port151.244.228.91:50050Cobalt Strikethreatfox
ip:port153.80.242.105:25Cobalt Strikethreatfox
ip:port153.80.242.105:22Cobalt Strikethreatfox
ip:port141.255.166.178:80Cobalt Strikethreatfox
ip:port141.255.166.178:443Cobalt Strikethreatfox
ip:port153.80.242.105:8447Cobalt Strikethreatfox
ip:port153.80.242.105:8445Cobalt Strikethreatfox
ip:port153.80.242.105:8008Cobalt Strikethreatfox
ip:port159.75.202.228:443Cobalt Strikethreatfox
ip:port141.255.166.178:8080Cobalt Strikethreatfox
ip:port47.95.201.24:9443Cobalt Strikethreatfox
ip:port47.113.98.42:50050Cobalt Strikethreatfox
ip:port223.109.142.7:50050Cobalt Strikethreatfox
ip:port129.204.11.247:50050Cobalt Strikethreatfox
ip:port153.80.242.105:3478Cobalt Strikethreatfox

+2941 indicators in total. See them all on the IOCs page.

References

FIN6 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →