FIN6
- ID
- G0037
- Associated names
- Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.[1][2]
Techniques used (40)
- T1003.001 LSASS Memory
- T1003.003 NTDS
- T1005 Data from Local System
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1027.010 Command Obfuscation
- T1036.004 Masquerade Task or Service
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1053.005 Scheduled Task
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1068 Exploitation for Privilege Escalation
- T1070.004 File Deletion
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1087.002 Domain Account
- T1095 Non-Application Layer Protocol
- T1102 Web Service
- T1110.002 Password Cracking
- T1119 Automated Collection
- T1134 Access Token Manipulation
- T1204.002 Malicious File
- T1213.006 Databases
- T1547.001 Registry Run Keys / Startup Folder
- T1553.002 Code Signing
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1560 Archive Collected Data
- T1560.003 Archive via Custom Method
- T1566.001 Spearphishing Attachment
- T1566.003 Spearphishing via Service
- T1569.002 Service Execution
- T1572 Protocol Tunneling
- T1573.002 Asymmetric Cryptography
- T1588.002 Tool
- T1685 Disable or Modify Tools
Software used (12)
- S0002 Mimikatz
- S0005 Windows Credential Editor
- S0029 PsExec
- S0154 Cobalt Strike
- S0284 More_eggs
- S0372 LockerGoga
- S0381 FlawedAmmyy
- S0446 Ryuk
- S0449 Maze
- S0503 FrameworkPOS
- S0552 AdFind
- S0632 GrimAgent