FIN6 — Ransomware Profile
FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.Also tracked as
Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest
Tools & malware
- AdFind Network Reconnaissance
- Cobalt Strike Adversary Simulation
- FlawedAmmyy Remote Access Trojan
- FrameworkPOS POS Malware
- GrimAgent Loader
- js.magecart Web Skimmer
- js.more_eggs Backdoor
- LockerGoga Ransomware
- Maze Ransomware
- Mimikatz Credential Harvesting
- More_eggs Backdoor
- PsExec Remote Execution
- Ryuk Ransomware
- win.cobalt_strike Adversary Simulation
- win.grateful_pos POS Malware
- win.lockergoga Ransomware
- win.maze Backdoor
- win.ryuk Ransomware
- win.terra_stealer Infostealer
- Windows Credential Editor Credential Harvesting
Vendor research
- How Microsoft names threat actors Microsoft
- CrowdStrike 2018 Global Threat Report Crowdstrike
- Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6 FireEye
- Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware FireEye
- ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework Security Intelligence ITG08
- More_eggs, Anyone? Threat Actor ITG08 Strikes Again Security Intelligence More Eggs