CVE Intelligence
Início / Grupos de ameaça / FIN6

FIN6 G0037

🔔 Criar alerta

Também conhecido como: Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

3
CVEs associadas
47
Técnicas
12
Malwares e ferramentas

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.

Operações de ransomware ligadas a este grupo ransomware.live

maze via Maze

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2013-3660 Alta · 7.8 KEV Microsoft Win32k Privilege Escalation Vulnerability
“The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.”
CVE-2011-2005 Alta · 7.8 KEV Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability
“The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.”
CVE-2010-4398 Alta · 7.8 KEV Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability
“The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.”

Técnicas por tática

Desenvolvimento de recursos
T1588.002 Tool
Acesso inicial
T1078 Valid AccountsT1566.001 Spearphishing AttachmentT1566.003 Spearphishing via Service
Execução
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.007 JavaScriptT1204.002 Malicious FileT1569.002 Service Execution
Persistência
T1053.005 Scheduled TaskT1078 Valid AccountsT1547.001 Registry Run Keys / Startup Folder
Escalada de privilégios
T1053.005 Scheduled TaskT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1134 Access Token ManipulationT1547.001 Registry Run Keys / Startup Folder
Furtividade
T1027.010 Command ObfuscationT1036.004 Masquerade Task or ServiceT1070.004 File DeletionT1078 Valid AccountsT1134 Access Token Manipulation
Comprometimento de defesas
T1553.002 Code SigningT1685 Disable or Modify Tools
Acesso a credenciais
T1003.001 LSASS MemoryT1003.003 NTDST1110.002 Password CrackingT1555 Credentials from Password StoresT1555.003 Credentials from Web Browsers
Descoberta
T1018 Remote System DiscoveryT1046 Network Service DiscoveryT1087.002 Domain Account
Movimento lateral
T1021.001 Remote Desktop Protocol
Coleta
T1005 Data from Local SystemT1074.002 Remote Data StagingT1119 Automated CollectionT1213.006 DatabasesT1560 Archive Collected DataT1560.003 Archive via Custom Method
Comando e controle
T1095 Non-Application Layer ProtocolT1102 Web ServiceT1572 Protocol TunnelingT1573.002 Asymmetric Cryptography
Exfiltração
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.