FIN6
Associated Group Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1047 | Windows管理规范 |
FIN6 has used WMI to automate the remote execution of PowerShell scripts.[4] |
|
| Enterprise | T1213 | 从信息存储库获取数据 |
FIN6 has collected schemas and user accounts from systems running SQL Server.[7] |
|
| Enterprise | T1555 | 从密码存储中获取凭证 |
FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.[7] |
|
| .003 | Credentials from Web Browsers |
FIN6 has used the Stealer One credential stealer to target web browsers.[7] |
||
| Enterprise | T1005 | 从本地系统获取数据 |
FIN6 has collected and exfiltrated payment card data from compromised systems.[8][9][10] |
|
| Enterprise | T1036 | .004 | 伪装: Masquerade Task or Service |
FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.[2] |
| Enterprise | T1573 | .002 | 加密通道: Asymmetric Cryptography |
FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.[1] |
| Enterprise | T1572 | 协议隧道 |
FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.[1] |
|
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.[1] |
| Enterprise | T1059 | 命令与脚本解释器 |
FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.[1][2] |
|
| .001 | PowerShell |
FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.[1][2][7] |
||
| .003 | Windows Command Shell | |||
| .007 | JavaScript |
FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.[8] |
||
| Enterprise | T1562 | .001 | 妨碍防御: Disable or Modify Tools |
FIN6 has deployed a utility script named |
| Enterprise | T1560 | 归档收集数据 |
Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.[1] |
|
| .003 | Archive via Custom Method |
FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.[1][8] |
||
| Enterprise | T1003 | .001 | 操作系统凭证转储: LSASS Memory |
FIN6 has used Windows Credential Editor for credential dumping.[1][2] |
| .003 | 操作系统凭证转储: NTDS |
FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.[1][2] |
||
| Enterprise | T1074 | .002 | 数据分段: Remote Data Staging |
FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.[1] |
| Enterprise | T1110 | .002 | 暴力破解: Password Cracking |
FIN6 has extracted password hashes from ntds.dit to crack offline.[1] |
| Enterprise | T1048 | .003 | 替代协议渗出: Exfiltration Over Unencrypted Non-C2 Protocol |
FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.[8] |
| Enterprise | T1078 | 有效账户 |
To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.[1][2][7] |
|
| Enterprise | T1068 | 权限提升漏洞利用 |
FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.[1] |
|
| Enterprise | T1027 | .010 | 混淆文件或信息: Command Obfuscation | |
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.[7] |
| Enterprise | T1070 | .004 | 移除指标: File Deletion | |
| Enterprise | T1569 | .002 | 系统服务: Service Execution |
FIN6 has created Windows services to execute encoded PowerShell commands.[2] |
| Enterprise | T1102 | 网络服务 |
FIN6 has used Pastebin and Google Storage to host content for their operations.[2] |
|
| Enterprise | T1046 | 网络服务发现 |
FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.[1] |
|
| Enterprise | T1119 | 自动化收集 |
FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.[1][8] |
|
| Enterprise | T1588 | .002 | 获取能力: Tool |
FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.[4][2] |
| Enterprise | T1134 | 访问令牌操控 |
FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.[2] |
|
| Enterprise | T1087 | .002 | 账号发现: Domain Account |
FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.[1] |
| Enterprise | T1021 | .001 | 远程服务: Remote Desktop Protocol | |
| Enterprise | T1018 | 远程系统发现 |
FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.[1] |
|
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
FIN6 has targeted victims with e-mails containing malicious attachments.[7] |
| .003 | 钓鱼: Spearphishing via Service |
FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.[4] |
||
| Enterprise | T1095 | 非应用层协议 | ||
| Enterprise | T1053 | .005 | 预定任务/作业: Scheduled Task |
FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.[1] |
| Enterprise | T1553 | .002 | 颠覆信任控制: Code Signing | |
Software
References
- FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.
- McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.
- Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020.
- Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.
- CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.
- Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
- Visa Public. (2019, February). FIN6 Cybercrime Group Expands Threat to eCommerce Merchants. Retrieved September 16, 2019.
- Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020.
- Klijnsma, Y. (2018, September 11). Inside the Magecart Breach of British Airways: How 22 Lines of Code Claimed 380,000 Victims. Retrieved September 9, 2020.
- Klijnsma, Y. (2018, September 19). Another Victim of the Magecart Assault Emerges: Newegg. Retrieved September 9, 2020.
- Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020.
- Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.
- Kennelly, J., Goody, K., Shilko, J. (2020, May 7). Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents. Retrieved May 18, 2020.