FIN6

Names and who uses them

• FIN6Our name
• Skeleton SpiderCrowdStrike
• Camouflage TempestMicrosoft
• TAALMicrosoft
• ITG08MITRE ATT&CK
• Magecart Group 6MITRE ATT&CK

Targets

Sectors: Healthcare, Retail, Hospitality

Known techniques

• T1003.001LSASS Memory
• T1003.003NTDS
• T1005Data from Local System
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1027.010Command Obfuscation
• T1036.004Masquerade Task or Service
• T1046Network Service Discovery
• T1047Windows Management Instrumentation
• T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
• T1053.005Scheduled Task
• T1059Command and Scripting Interpreter
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.007JavaScript
• T1068Exploitation for Privilege Escalation
• T1070.004File Deletion
• T1074.002Remote Data Staging
• T1078Valid Accounts
• T1087.002Domain Account
• T1095Non-Application Layer Protocol
• T1102Web Service
• T1110.002Password Cracking
• T1119Automated Collection
• T1134Access Token Manipulation
• T1204.002Malicious File
• T1213.006Databases
• T1547.001Registry Run Keys / Startup Folder
• T1553.002Code Signing
• T1555Credentials from Password Stores
• T1555.003Credentials from Web Browsers
• T1560Archive Collected Data
• T1560.003Archive via Custom Method
• T1566.001Spearphishing Attachment
• T1566.003Spearphishing via Service
• T1569.002Service Execution
• T1572Protocol Tunneling
• T1573.002Asymmetric Cryptography
• T1588.002Tool
• T1685Disable or Modify Tools

Malware and tools used