H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Group

FIN6

[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

Group
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

52 recorded

Relationships

uses
to Access Token Manipulation
Technique
uses
to AdFind
Tool
uses
to Archive Collected Data
Technique
uses
to Archive via Custom Method
Technique
uses
to Asymmetric Cryptography
Technique
uses
to Automated Collection
Technique
uses
to Cobalt Strike
Malware
uses
to Code Signing
Technique
uses
to Command and Scripting Interpreter
Technique
uses
to Command Obfuscation
Technique
uses
to Credentials from Password Stores
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Databases
Technique
uses
to Data from Local System
Technique
uses
to Disable or Modify Tools
Technique
uses
to Domain Account
Technique
uses
to Exfiltration Over Unencrypted Non-C2 Protocol
Technique
uses
to Exploitation for Privilege Escalation
Technique
uses
to File Deletion
Technique
uses
to FlawedAmmyy
Malware
uses
to FrameworkPOS
Malware
uses
to GrimAgent
Malware
uses
to JavaScript
Technique
uses
to LockerGoga
Malware
uses
to LSASS Memory
Technique
uses
to Malicious File
Technique
uses
to Masquerade Task or Service
Technique
uses
to Maze
Malware
uses
to Mimikatz
Tool
uses
to More_eggs
Malware
uses
to Network Service Discovery
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to NTDS
Technique
uses
to Password Cracking
Technique
uses
to PowerShell
Technique
uses
to Protocol Tunneling
Technique
uses
to PsExec
Tool
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Remote Data Staging
Technique
uses
to Remote Desktop Protocol
Technique
uses
to Remote System Discovery
Technique
uses
to Ryuk
Malware
uses
to Scheduled Task
Technique
uses
to Service Execution
Technique
uses
to Spearphishing Attachment
Technique
uses
to Spearphishing via Service
Technique
uses
to Tool
Technique
uses
to Valid Accounts
Technique
uses
to Web Service
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Credential Editor
Tool
uses
to Windows Management Instrumentation
Technique
13 external

References

mitre-attack
G0037
open
Skeleton Spider
—
FIN6
—
TAAL
—
Camouflage Tempest
—
Magecart Group 6
—
ITG08
—
Crowdstrike Global Threat Report Feb 2018
https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report
open
FireEye FIN6 April 2016
https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf
open
FireEye FIN6 Apr 2019
https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
open
Microsoft Threat Actor Naming July 2023
https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
open
Security Intelligence ITG08 April 2020
https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/
open
Security Intelligence More Eggs Aug 2019
https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance