FIN6
FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.
- ATT&CK ID
- G0037
- Weather family
- Tempest
- Techniques
- 33
- Tools
- 12
Also tracked as Magecart Group 6 · ITG08 · Skeleton Spider · TAAL · Camouflage Tempest
Vulnerabilities it has exploited
- CVE-2010-4398 Microsoft WindowsUnscored · exploited in the wild
- CVE-2011-2005 Microsoft Ancillary Function Driver (afd.sys)Unscored · exploited in the wild
- CVE-2013-3660 Microsoft Win32kUnscored · exploited in the wild
Techniques
Resource Development
Initial Access
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterUser ExecutionSystem Services
Persistence
Scheduled Task/JobValid AccountsBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobExploitation for Privilege EscalationValid AccountsAccess Token ManipulationBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalValid AccountsAccess Token Manipulation
Defense Impairment
Subvert Trust ControlsDisable or Modify Tools
Credential Access
OS Credential DumpingBrute ForceCredentials from Password Stores
Discovery
Remote System DiscoveryNetwork Service DiscoveryAccount Discovery
Lateral Movement
Collection
Data from Local SystemData StagedAutomated CollectionData from Information RepositoriesArchive Collected Data
Command and Control
Non-Application Layer ProtocolWeb ServiceProtocol TunnelingEncrypted Channel
Exfiltration
Exfiltration Over Alternative Protocol
Software
AdFind · Cobalt Strike · FlawedAmmyy · FrameworkPOS · GrimAgent · LockerGoga · Maze · Mimikatz · More_eggs · PsExec · Ryuk · Windows Credential Editor