FIN6

APT / StateG0037 ↗
Techniques (MITRE ATT&CK)40
SourceMITRE ATT&CK
0
Also known as:Magecart Group 6ITG08Skeleton SpiderTAALCamouflage Tempest

Vexday analysis

FIN6 (também referenciado como Magecart Group 6, ITG08, Skeleton Spider, TAAL e Camouflage Tempest) é um grupo cibercriminoso especializado no roubo de dados de cartões de pagamento para revenda em mercados clandestinos. O grupo tem como alvos prioritários sistemas de ponto de venda (PoS) nos setores de hospitalidade e varejo, conduzindo comprometimentos de forma agressiva e sistemática. Ao grupo são atribuídas 40 técnicas documentadas no MITRE ATT&CK (identificador G0037) e a exploração de 3 CVEs conhecidas.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity65
Impact: High
T1566.001T1047T1547.001T1068T1021.001T1005ENTRYInitial accessSpearphishingAttachmentEXECExecutionWindows ManagementInstrumentationPERSPersistenceRegistry Run Keys/ Startup FolderPRIVPrivilege escalationExploitation forPrivilege Escalat…LATLateral movementRemote DesktopProtocolCOLLCollectionData from LocalSystemEXFILExfiltrationExfiltration OverUnencrypted Non-C…

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 40

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development
Tool
Initial access
Spearphishing AttachmentSpearphishing via Service
Execution
Windows Management InstrumentationScheduled TaskCommand and Scripting InterpreterPowerShellWindows Command ShellJavaScriptMalicious FileService Execution
Persistence
Registry Run Keys / Startup Folder
Privilege escalation
Exploitation for Privilege Escalation
Credential access
LSASS MemoryNTDSPassword CrackingCredentials from Password StoresCredentials from Web Browsers
Discovery
Remote System DiscoveryNetwork Service DiscoveryDomain Account
Lateral movement
Remote Desktop Protocol
Collection
Data from Local SystemRemote Data StagingAutomated CollectionDatabasesArchive Collected DataArchive via Custom Method
Command and control
Non-Application Layer ProtocolWeb ServiceProtocol TunnelingAsymmetric Cryptography
Exfiltration
Exfiltration Over Unencrypted Non-C2 Protocol
defense-impairment
Code SigningDisable or Modify Tools
stealth
Command ObfuscationMasquerade Task or ServiceFile DeletionValid AccountsAccess Token Manipulation

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2013-3660HIGHEPSS 40%KEVCVE-2011-2005HIGHEPSS 32%KEVCVE-2010-4398HIGHEPSS 9%KEV

Known infrastructure 1313

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port149.88.66.234:2020Cobalt Strikethreatfox
ip:port47.236.53.104:443Cobalt Strikethreatfox
ip:port47.237.89.109:443Cobalt Strikethreatfox
ip:port106.53.181.14:8443Cobalt Strikethreatfox
ip:port116.204.119.99:443Cobalt Strikethreatfox
ip:port106.14.16.18:22Cobalt Strikethreatfox
ip:port107.172.217.148:22Cobalt Strikethreatfox
ip:port107.172.217.148:8080Cobalt Strikethreatfox
ip:port107.172.217.148:443Cobalt Strikethreatfox
ip:port23.95.48.157:8888Cobalt Strikethreatfox
ip:port123.60.81.230:81Cobalt Strikethreatfox
ip:port107.172.217.148:80Cobalt Strikethreatfox
ip:port1.13.19.103:8080Cobalt Strikethreatfox
ip:port1.13.19.103:22Cobalt Strikethreatfox
ip:port1.13.19.103:80Cobalt Strikethreatfox
ip:port1.13.19.103:443Cobalt Strikethreatfox
ip:port23.141.12.111:1080Cobalt Strikethreatfox
ip:port47.84.15.240:8080Cobalt Strikethreatfox
ip:port47.84.15.240:80Cobalt Strikethreatfox
ip:port4.253.8.171:443Cobalt Strikethreatfox
ip:port47.84.15.240:443Cobalt Strikethreatfox
ip:port118.196.95.249:8080Cobalt Strikethreatfox
ip:port116.198.42.177:8081Cobalt Strikethreatfox
ip:port118.196.95.249:80Cobalt Strikethreatfox
ip:port118.196.95.249:443Cobalt Strikethreatfox
ip:port118.196.95.249:22Cobalt Strikethreatfox
ip:port116.198.42.177:8080Cobalt Strikethreatfox
ip:port116.198.42.177:443Cobalt Strikethreatfox
ip:port116.198.42.177:80Cobalt Strikethreatfox
ip:port116.198.42.177:22Cobalt Strikethreatfox

+1313 indicators in total. See them all on the IOCs page.

References

FIN6 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →