Trusted Design

FIN6

G0037 · MITRE Pageへのリンク

脅威アクターの詳細

[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

別名・別称

FIN6
Magecart Group 6
ITG08
Skeleton Spider
TAAL
Camouflage Tempest

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1047 - Windows Management Instrumentation
• T1059.007 - JavaScript
• T1560.003 - Archive via Custom Method
• T1110.002 - Password Cracking
• T1087.002 - Domain Account
• T1204.002 - Malicious File
• T1213.006 - Databases
• T1566.001 - Spearphishing Attachment
• T1119 - Automated Collection
• T1553.002 - Code Signing
• T1074.002 - Remote Data Staging
• T1005 - Data from Local System
• T1555 - Credentials from Password Stores
• T1572 - Protocol Tunneling
• T1560 - Archive Collected Data
• T1555.003 - Credentials from Web Browsers
• T1003.001 - LSASS Memory
• T1059 - Command and Scripting Interpreter
• T1036.004 - Masquerade Task or Service
• T1102 - Web Service
• T1059.001 - PowerShell
• T1547.001 - Registry Run Keys / Startup Folder
• T1588.002 - Tool
• T1562.001 - Disable or Modify Tools
• T1078 - Valid Accounts
• T1068 - Exploitation for Privilege Escalation
• T1573.002 - Asymmetric Cryptography
• T1095 - Non-Application Layer Protocol
• T1059.003 - Windows Command Shell
• T1027.010 - Command Obfuscation
• T1070.004 - File Deletion
• T1134 - Access Token Manipulation
• T1018 - Remote System Discovery
• T1046 - Network Service Discovery
• T1021.001 - Remote Desktop Protocol
• T1003.003 - NTDS
• T1569.002 - Service Execution
• T1566.003 - Spearphishing via Service
• T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1569.002)
• CVE-2017-0143 (T1566.003)
• CVE-2014-0322 (T1569.002)
• CVE-2015-2419 (T1059.007)
• CVE-2016-0189 (T1027.010)
• CVE-2015-1770 (T1569.002)
• CVE-2015-2545 (T1569.002)
• CVE-2017-0199 (T1569.002)
• CVE-2012-0158 (T1569.002)
• CVE-2013-3906 (T1027.010)
• CVE-2014-6352 (T1569.002)
• CVE-2015-0016 (T1068)
• CVE-2010-3333 (T1046)
• CVE-2010-0188 (T1059.003)
• CVE-2010-2884 (T1059.003)
• CVE-2013-0640 (T1059.003)
• CVE-2011-0611 (T1566.003)
• CVE-2015-2424 (T1213.006)
• CVE-2014-1761 (T1566.001)
• CVE-2015-1641 (T1213.006)
• CVE-2017-0261 (T1018)
• CVE-2017-0262 (T1018)
• CVE-2013-6282 (T1562.001)
• CVE-2013-2465 (T1566.003)
• CVE-2013-2551 (T1213.006)
• CVE-2013-0634 (T1566.003)
• CVE-2014-7247 (T1566.003)
• CVE-2013-0641 (T1059.003)
• CVE-2013-5990 (T1566.003)
• CVE-2025-54313 (T1213.006)
• CVE-2010-1553 (T1566.003)
• CVE-2015-2853 (T1566.001)
• CVE-2017-16929 (T1036.004)
• CVE-2012-1876 (T1566.001)
• CVE-2012-2539 (T1566.001)
• CVE-2013-3660 (T1068)
• CVE-2013-7331 (T1569.002)
• CVE-2009-3129 (T1566.003)
• CVE-2014-0329 (T1562.001)
• CVE-2015-7261 (T1555)
• CVE-2015-8286 (T1555)
• CVE-2016-2343 (T1102)
• CVE-2016-6532 (T1102)
• CVE-2016-9495 (T1555)
• CVE-2012-0507 (T1566.003)
• CVE-2014-3393 (T1566.003)
• CVE-2015-2546 (T1566.003)
• CVE-2015-3785 (T1562.001)
• CVE-2015-5897 (T1068)
• CVE-2015-3456 (T1078)
• CVE-2013-2094 (T1068)
• CVE-2014-4113 (T1569.002)
• CVE-2015-8562 (T1095)
• CVE-2016-1990 (T1068)
• CVE-2016-1991 (T1095)
• CVE-2015-1701 (T1569.002)
• CVE-2015-3628 (T1068)
• CVE-2015-6034 (T1068)
• CVE-2015-6022 (T1555.003)
• CVE-2015-7262 (T1068)
• CVE-2016-1562 (T1562.001)
• CVE-2017-0263 (T1566.003)
• CVE-2016-9496 (T1078)
• CVE-2012-0056 (T1068)
• CVE-2010-3081 (T1046)
• CVE-2012-1258 (T1046)
• CVE-2014-3153 (T1068)
• CVE-2015-3636 (T1068)
• CVE-2015-0057 (T1569.002)
• CVE-2015-1761 (T1068)
• CVE-2015-2360 (T1569.002)
• CVE-2014-6324 (T1068)
• CVE-2008-1436 (T1569.002)
• CVE-2010-0232 (T1068)
• CVE-2010-4398 (T1046)
• CVE-2014-2273 (T1562.001)
• CVE-2015-2387 (T1068)
• CVE-2017-0001 (T1566.003)
• CVE-2025-13335 (T1555.003)
• CVE-2025-13927 (T1078)
• CVE-2025-13928 (T1078)
• CVE-2025-24893 (T1566.003)
• CVE-2025-68645 (T1046)
• CVE-2026-1102 (T1078)
• CVE-2026-20127 (T1068)
• CVE-2012-1856 (T1569.002)
• CVE-2012-4969 (T1569.002)
• CVE-2014-4148 (T1569.002)
• CVE-2015-5477 (T1036.004)
• CVE-2012-4681 (T1068)
• CVE-2014-6271 (T1566.003)
• CVE-2016-0984 (T1068)
• CVE-2016-1287 (T1566.003)
• CVE-2016-9494 (T1068)
• CVE-2017-3212 (T1562.001)
• CVE-2025-55182 (T1562.001)
• CVE-2014-7911 (T1562.001)
• CVE-2014-4322 (T1068)
• CVE-2015-3105 (T1562.001)
• CVE-2015-0310 (T1068)
• CVE-2014-1776 (T1078)
• CVE-2014-0556 (T1566.003)
• CVE-2010-1297 (T1059.003)
• CVE-2011-3402 (T1562.001)
• CVE-2015-2426 (T1562.001)
• CVE-2012-6422 (T1566.003)
• CVE-2013-2595 (T1068)
• CVE-2012-0611 (T1068)
• CVE-2017-7255 (T1018)
• CVE-2025-34026 (T1562.001)
• CVE-2025-55183 (T1078)
• CVE-2025-55184 (T1562.001)
• CVE-2015-4495 (T1068)
• CVE-2015-7808 (T1095)
• CVE-2016-1019 (T1566.003)
• CVE-2010-0738 (T1566.003)
• CVE-2011-1255 (T1003.003)
• CVE-2023-1389 (T1566.003)
• CVE-2025-31125 (T1078)
• CVE-2015-5119 (T1068)
• CVE-2015-5122 (T1018)
• CVE-2015-7645 (T1068)
• CVE-2015-3043 (T1018)
• CVE-2015-3090 (T1566.003)
• CVE-2015-3113 (T1068)
• CVE-2015-2590 (T1068)
• CVE-2015-2502 (T1569.002)
• CVE-2016-1010 (T1566.003)
• CVE-2016-0998 (T1566.003)
• CVE-2015-0313 (T1068)
• CVE-2015-0359 (T1018)
• CVE-2015-5130 (T1566.003)
• CVE-2015-5134 (T1566.003)
• CVE-2015-5539 (T1566.003)
• CVE-2015-5557 (T1566.003)
• CVE-2015-5563 (T1566.003)
• CVE-2015-5559 (T1566.003)
• CVE-2015-5540 (T1566.003)
• CVE-2015-5561 (T1566.003)
• CVE-2015-5551 (T1566.003)
• CVE-2015-5564 (T1566.003)
• CVE-2015-5565 (T1566.003)
• CVE-2015-5550 (T1566.003)
• CVE-2015-5566 (T1566.003)
• CVE-2015-5127 (T1566.003)
• CVE-2015-5556 (T1566.003)
• CVE-2015-0311 (T1068)
• CVE-2015-0336 (T1566.003)
• CVE-2015-2854 (T1095)
• CVE-2016-1898 (T1095)
• CVE-2016-1897 (T1095)
• CVE-2010-2883 (T1046)
• CVE-2014-6332 (T1569.002)
• CVE-2014-8440 (T1018)
• CVE-2016-2342 (T1046)
• CVE-2014-8439 (T1046)
• CVE-2014-9163 (T1046)
• CVE-2010-0806 (T1046)
• CVE-2015-1427 (T1566.003)
• CVE-2016-1001 (T1566.003)
• CVE-2015-4902 (T1566.003)
• CVE-2017-8570 (T1566.003)
• CVE-2025-66478 (T1566.003)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る