CybercrimeMITRE G0037
FIN6
Also known as SKELETON SPIDER, ITG08, MageCart Group 6, White Giant, GOLD FRANKLIN, ATK88, G0037, Camouflage Tempest, TA4557, Storm-0538, SQUID COMET, TAAL
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
FIN is a group targeting financial assets including assets able to do financial transaction including PoS.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1003.001 LSASS MemoryT1003.003 NTDST1005 Data from Local SystemT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1027.010 Command ObfuscationT1036.004 Masquerade Task or ServiceT1046 Network Service DiscoveryT1047 Windows Management InstrumentationT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.007 JavaScriptT1068 Exploitation for Privilege EscalationT1070.004 File DeletionT1074.002 Remote Data StagingT1078 Valid AccountsT1087.002 Domain AccountT1095 Non-Application Layer ProtocolT1102 Web ServiceT1110.002 Password CrackingT1119 Automated CollectionT1134 Access Token ManipulationT1204.002 Malicious FileT1213.006 DatabasesT1547.001 Registry Run Keys / Startup FolderT1553.002 Code SigningT1555 Credentials from Password StoresT1555.003 Credentials from Web BrowsersT1560 Archive Collected DataT1560.003 Archive via Custom MethodT1566.001 Spearphishing AttachmentT1566.003 Spearphishing via ServiceT1569.002 Service ExecutionT1572 Protocol TunnelingT1573.002 Asymmetric CryptographyT1588.002 ToolT1685 Disable or Modify Tools
Recent activity
No posts or advisories have named this actor recently.
References
- https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
- https://attack.mitre.org/groups/G0037/
- https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/
- http://www.secureworks.com/research/threat-profiles/gold-franklin
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta4557-targets-recruiters-directly-email
- https://www.proofpoint.com/us/threat-insight/post/fake-jobs-campaigns-delivering-moreeggs-backdoor-fake-job-offers
- https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/
- https://attack.mitre.org/groups/G0037
- https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.