CVE Intelligence
Home / Threat actors / FIN6

FIN6 G0037

🔔 Create alert

Also known as: Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

3
associated CVEs
47
Techniques
12
Malware and tools

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.

Ransomware operations linked to this group ransomware.live

maze via Maze

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2013-3660 High · 7.8 KEV Microsoft Win32k Privilege Escalation Vulnerability
“The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.”
CVE-2011-2005 High · 7.8 KEV Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability
“The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.”
CVE-2010-4398 High · 7.8 KEV Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability
“The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.”

Techniques by tactic

Resource Development
T1588.002 Tool
Initial Access
T1078 Valid AccountsT1566.001 Spearphishing AttachmentT1566.003 Spearphishing via Service
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.007 JavaScriptT1204.002 Malicious FileT1569.002 Service Execution
Persistence
T1053.005 Scheduled TaskT1078 Valid AccountsT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1134 Access Token ManipulationT1547.001 Registry Run Keys / Startup Folder
Stealth
T1027.010 Command ObfuscationT1036.004 Masquerade Task or ServiceT1070.004 File DeletionT1078 Valid AccountsT1134 Access Token Manipulation
Defense Impairment
T1553.002 Code SigningT1685 Disable or Modify Tools
Credential Access
T1003.001 LSASS MemoryT1003.003 NTDST1110.002 Password CrackingT1555 Credentials from Password StoresT1555.003 Credentials from Web Browsers
Discovery
T1018 Remote System DiscoveryT1046 Network Service DiscoveryT1087.002 Domain Account
Lateral Movement
T1021.001 Remote Desktop Protocol
Collection
T1005 Data from Local SystemT1074.002 Remote Data StagingT1119 Automated CollectionT1213.006 DatabasesT1560 Archive Collected DataT1560.003 Archive via Custom Method
Command and Control
T1095 Non-Application Layer ProtocolT1102 Web ServiceT1572 Protocol TunnelingT1573.002 Asymmetric Cryptography
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.