Loading IOCs…

{'aliases': ['FIN6',
             'Magecart Group 6',
             'ITG08',
             'Skeleton Spider',
             'TAAL',
             'Camouflage Tempest'],
 'created': '2017-05-31T21:32:06.015Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[FIN6](https://attack.mitre.org/groups/G0037) is a cyber '
                'crime group that has stolen payment card data and sold it for '
                'profit on underground marketplaces. This group has '
                'aggressively targeted and compromised point of sale (PoS) '
                'systems in the hospitality and retail sectors.(Citation: '
                'FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)',
 'external_references': [{'external_id': 'G0037',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0037'},
                         {'description': '(Citation: Crowdstrike Global Threat '
                                         'Report Feb 2018)',
                          'source_name': 'Skeleton Spider'},
                         {'description': '(Citation: FireEye FIN6 April 2016)',
                          'source_name': 'FIN6'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)',
                          'source_name': 'TAAL'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)',
                          'source_name': 'Camouflage Tempest'},
                         {'description': '(Citation: Security Intelligence '
                                         'ITG08 April 2020)',
                          'source_name': 'Magecart Group 6'},
                         {'description': '(Citation: Security Intelligence '
                                         'More Eggs Aug 2019)',
                          'source_name': 'ITG08'},
                         {'description': 'CrowdStrike. (2018, February 26). '
                                         'CrowdStrike 2018 Global Threat '
                                         'Report. Retrieved October 10, 2018.',
                          'source_name': 'Crowdstrike Global Threat Report Feb '
                                         '2018',
                          'url': 'https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report'},
                         {'description': 'FireEye Threat Intelligence. (2016, '
                                         'April). Follow the Money: Dissecting '
                                         'the Operations of the Cyber Crime '
                                         'Group FIN6. Retrieved November 17, '
                                         '2024.',
                          'source_name': 'FireEye FIN6 April 2016',
                          'url': 'https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf'},
                         {'description': 'McKeague, B. et al. (2019, April 5). '
                                         'Pick-Six: Intercepting a FIN6 '
                                         'Intrusion, an Actor Recently Tied to '
                                         'Ryuk and LockerGoga Ransomware. '
                                         'Retrieved April 17, 2019.',
                          'source_name': 'FireEye FIN6 Apr 2019',
                          'url': 'https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html'},
                         {'description': 'Microsoft . (2023, July 12). How '
                                         'Microsoft names threat actors. '
                                         'Retrieved November 17, 2023.',
                          'source_name': 'Microsoft Threat Actor Naming July '
                                         '2023',
                          'url': 'https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide'},
                         {'description': 'Villadsen, O. (2020, April 7). ITG08 '
                                         '(aka FIN6) Partners With TrickBot '
                                         'Gang, Uses Anchor Framework. '
                                         'Retrieved October 8, 2020.',
                          'source_name': 'Security Intelligence ITG08 April '
                                         '2020',
                          'url': 'https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/'},
                         {'description': 'Villadsen, O.. (2019, August 29). '
                                         'More_eggs, Anyone? Threat Actor '
                                         'ITG08 Strikes Again. Retrieved '
                                         'September 16, 2019.',
                          'source_name': 'Security Intelligence More Eggs Aug '
                                         '2019',
                          'url': 'https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/'}],
 'id': 'intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb',
 'modified': '2024-11-17T14:59:25.749Z',
 'name': 'FIN6',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Center for Threat-Informed Defense (CTID)',
                          'Drew Church, Splunk'],
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack', 'ics-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '4.0'}