FIN6 is a financially motivated group that built its reputation stealing payment card data from point of sale (PoS) systems and checkout pages, then turned the same domain-admin tradecraft to ransomware deployment. Whatever the payout, its intrusions follow one pattern: stolen credentials, Active Directory reconnaissance, a copy of the domain database and mass deployment with PsExec or Cobalt Strike. This profile is for SOC analysts, Active Directory and identity teams, and retail, hospitality and e-commerce security staff. It covers names as each source states them, targeting, the ATT&CK techniques mapped to the group, its heavy use of credentials, notable activity and a detection and hardening plan. For the browser side of card theft, see the Client-Side Security Guide; general group background is in the Threat Actor Groups Guide.
Key takeaways
- Credentials are the whole operation. ATT&CK records LSASS dumping, copying ntds.dit with a Metasploit NTDSGRAB module, offline password cracking and lateral movement with stolen valid accounts. Mandiant saw ransomware deployed with compromised domain administrator credentials.
- It has worked across three kinds of target. PoS networks in retail and hospitality, e-commerce checkout pages (IBM X-Force links it to Magecart Group 6) and, from 2018, enterprise networks for ransomware.
- Fake job offers open the door. IBM X-Force saw LinkedIn messages and emails with fake job adverts delivering the More_eggs backdoor to handpicked employees of multinationals.
- Living off admin tools makes it noisy in the right logs. AdFind queries, PsExec services renamed "mstdc", random 16-character service names and encoded PowerShell are stable detection points.
- Tiered admin and LAPS break the chain. If domain admin credentials never touch workstations and local admin passwords are unique, FIN6's lateral movement slows dramatically.
Who they are (names and aliases)
MITRE ATT&CK tracks FIN6 (G0037) as a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces, and that has aggressively targeted PoS systems in the hospitality and retail sectors. FIN6 is a Mandiant (formerly FireEye) name. IBM X-Force tracks the group as ITG08, active since 2015, and states that Magecart Group 6 is the same group. ATT&CK lists further aliases from other vendors.
| Name | Tracked by | Notes |
|---|---|---|
| FIN6 | Mandiant (FireEye), ATT&CK | Most common public name |
| ITG08 | IBM X-Force | IBM links ITG08 to Magecart Group 6 and to the TrickBot gang's Anchor framework |
| Magecart Group 6 | Listed in ATT&CK and IBM X-Force | Online skimming cluster |
| Skeleton Spider | CrowdStrike, listed in ATT&CK | Vendor alias |
| Camouflage Tempest | Microsoft, listed in ATT&CK | Microsoft's weather-based naming scheme |
| TAAL | Listed in ATT&CK | Vendor alias |
Mandiant noted that some FIN6 operators may work independently of the wider group, which it could not confirm, and IBM's ransomware link is worded as a possibility ("may also be part of"). Keep that uncertainty in your records.
Targeting and motivation
- Retail and hospitality PoS: IBM describes long-running card theft from PoS machines in US and European retailers and hospitality firms; ATT&CK maps the FrameworkPOS malware to FIN6.
- E-commerce: ATT&CK records malicious JavaScript stealing card data from e-commerce sites, including a script that binds to the submit payment button. See the Cybersecurity for Retail and Ecommerce Guide.
- Ransomware: Mandiant tied FIN6 to Ryuk and LockerGoga intrusions dating to July 2018, reported to have cost victims tens of millions of dollars, and intercepted an intrusion at an engineering company with no card data at all. ATT&CK also maps Maze to the group.
- Multinationals via staff: IBM saw fake job lures against selected employees of multinational organisations.
- Motivation: money. Mandiant suggests the group may have shifted from card theft towards extortion as ransomware earnings grew.
Tactics and techniques (MITRE ATT&CK)
All techniques below are mapped to G0037 in ATT&CK v20. Software mapped to the group includes More_eggs (S0284), FrameworkPOS (S0503), GrimAgent (S0632), FlawedAmmyy (S0381), Cobalt Strike (S0154), Mimikatz (S0002), Windows Credential Editor (S0005), AdFind (S0552), PsExec (S0029), Ryuk (S0446), LockerGoga (S0372) and Maze (S0449).
| Tactic | Technique | How it shows up |
|---|---|---|
| Initial access | T1566.001 Spearphishing Attachment; T1566.003 Spearphishing via Service | Malicious documents; fake job adverts over LinkedIn |
| Initial access, persistence | T1078 Valid Accounts | Stolen usernames and hashes reused to move and persist |
| Execution | T1059.001 PowerShell; T1047 WMI; T1569.002 Service Execution | Encoded PowerShell run through WMI or new Windows services |
| Persistence | T1547.001 Run Keys; T1053.005 Scheduled Task | HARDTACK and SHIPBREAD downloaders, FrameworkPOS |
| Privilege escalation | T1134 Access Token Manipulation; T1068 Exploitation for Privilege Escalation | Metasploit named pipe impersonation to SYSTEM; older Windows local exploits |
| Credential access | T1003.001 LSASS Memory; T1003.003 NTDS; T1110.002 Password Cracking | Windows Credential Editor, NTDSGRAB copy of ntds.dit, offline cracking |
| Credential access | T1555 and T1555.003 Credentials from Password Stores and Web Browsers | Stealer One against mail, FTP clients and browsers |
| Discovery | T1087.002 Domain Account; T1018 Remote System Discovery; T1046 Network Service Discovery | AdFind queries for users, computers, OUs, subnets and trusts; osql.exe mapping |
| Collection | T1213.006 Databases; T1119 Automated Collection | SQL Server schemas and accounts; scripts collecting card data from PoS hosts |
| Lateral movement | T1021.001 Remote Desktop Protocol | RDP with stolen credentials |
| Stealth | T1036.004 Masquerade Task or Service; T1553.002 Code Signing | PsExec service renamed "mstdc"; Comodo code-signing certificates |
| Defence impairment | T1685 Disable or Modify Tools | kill.bat disabling antivirus before ransomware |
| Command and control | T1572 Protocol Tunneling; T1102 Web Service | Plink SSH tunnels; Pastebin and Google Storage |
| Exfiltration | T1074.002 Remote Data Staging; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol | Staging on internal hosts; card data sent by HTTP POST |
How they abuse identities and credentials
FIN6 is an identity attacker that happens to want cards or ransom. Every stage, from first hop to mass deployment, runs on accounts it has stolen.
| Stage | Identity abused | Control that limits it |
|---|---|---|
| Foothold | Credentials used over RDP after compromise of an internet-facing system (Mandiant) | No direct RDP from the internet; MFA on all remote access; see the Remote Desktop (RDP) Security Guide |
| Expansion | A second set of credentials with extra domain group memberships (Mandiant) | Review nested group membership; remove standing privileged groups from ordinary accounts |
| Credential harvest | LSASS memory and ntds.dit copies, then offline cracking (ATT&CK) | Credential Guard, LSA protection, alerts on ntds.dit access and shadow copy creation on domain controllers |
| Local admin reuse | Hashes reused across hosts | Windows LAPS for unique local admin passwords; deny network logon for local accounts |
| Mass deployment | Compromised domain administrator credentials passed to PsExec (Mandiant) | Tiered administration, Protected Users group, privileged access workstations, just-in-time domain admin |
| Application credentials | Mail, FTP and browser credentials taken by Stealer One; SQL Server user accounts collected | Vaulted service credentials, no saved FTP passwords on endpoints, SQL logins reviewed and rotated |
For response when this happens, see the Active Directory Domain Compromise Response Playbook; for monitoring, the Active Directory Security Monitoring and Event IDs Guide.
Notable incidents
| Date | Activity | Source |
|---|---|---|
| 2015 onward | PoS card theft in US and European retail and hospitality | IBM X-Force; ATT&CK |
| April 2016 | FireEye publishes its FIN6 report on PoS intrusions and card sales | FireEye, via ATT&CK |
| July 2018 onward | Intrusions deploying Ryuk and LockerGoga ransomware tied to FIN6 | Mandiant, 5 April 2019 |
| 2019 | Engineering company intrusion contained within two hours; AdFind, Cobalt Strike, PsExec "mstdc" service | Mandiant, 5 April 2019 |
| 2019 | Fake job lures over LinkedIn and email deliver More_eggs to multinational employees; online skimming | IBM X-Force |
| Around 2020 | Use of the TrickBot gang's Anchor framework against PoS environments | IBM X-Force |
Detection and defence
Detection signals
| Signal | Where to look | Notes |
|---|---|---|
| New services with random 16-character names or names close to real ones, such as "mstdc" | System log Event ID 7045, Security Event ID 4697 | Mandiant's key indicator; the event shows which account installed the service |
| adfind.exe execution, especially with trust or person queries | Process creation (4688, Sysmon 1) | Followed by 7-Zip archives of the output |
| Encoded PowerShell (-enc) started by services or WMI | PowerShell Script Block Logging (Event ID 4104) | IBM recommends script logging |
| Access to ntds.dit or volume shadow copies on domain controllers | EDR on DCs, Event ID 4662 for directory replication rights | Domain database theft |
| regsvr32.exe or msxsl.exe loading scripts from user paths | EDR process trees | More_eggs delivery chain (IBM) |
| Domain admin accounts logging on to workstations or servers outside the admin tier | Event ID 4624 with logon type 3 or 10 | Tiering violation and likely misuse |
| plink.exe or outbound SSH from Windows servers | Process creation, firewall logs | Tunnelled C2 |
| Unexpected script changes on checkout pages | Page integrity monitoring, CSP violation reports | Online skimming |
Hardening plan
- Week 1: remove direct internet RDP, enforce MFA on all remote access, and alert on Event ID 7045 service creation across servers. See the Cobalt Strike Abuse Detection Guide.
- Weeks 2 to 4: deploy Windows LAPS, block network logon for local accounts and enable PowerShell Script Block Logging. Pilot LAPS on one OU, check that support tooling still works, then extend.
- Weeks 4 to 8: enforce admin tiering so domain admins log on only to domain controllers and privileged access workstations; add privileged users to Protected Users; enable Credential Guard and LSA protection on a pilot ring first, keeping the GPO ready to revert if legacy software breaks.
- Quarter 1: for card environments, segment PoS networks and apply the PCI DSS v4.0 payment page controls (requirement 6.4.3 script inventory and authorisation, 11.6.1 change and tamper detection). Restrict AdFind, PsExec and Plink by application control on non-admin hosts.
- Response: assume domain compromise once ntds.dit access is seen: reset the KRBTGT password twice, rotate all privileged and service account passwords and follow your domain compromise playbook.
Metrics
- Workstations and servers with unique LAPS-managed local admin passwords: 100%.
- Domain admin logons outside Tier 0 per month: zero.
- Unexplained service installations (7045) on servers: each investigated within 24 hours.
- Internet-exposed RDP endpoints: zero.
- Payment page scripts with documented authorisation: 100%.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | AC-6 Least Privilege, AC-17 Remote Access | Admin tiering and remote access MFA |
| NIST SP 800-53 Rev. 5 | IA-5 Authenticator Management, SI-4 System Monitoring | LAPS, credential rotation and service creation monitoring |
| NIST CSF 2.0 | PR.AA-05, DE.CM-09, DE.AE-02 | Access permissions with least privilege, endpoint monitoring, alert analysis |
| PCI DSS v4.0 | Requirements 6.4.3 and 11.6.1 | Payment page script control against skimming |
| MITRE D3FEND | D3-EAL Executable Allowlisting | Blocking admin tools on non-admin hosts |
Practitioner checklist
- Confirm no domain admin credentials are used on workstations or member servers.
- Deploy Windows LAPS everywhere and deny network logon for local accounts.
- Alert on Event ID 7045 services with random or lookalike names.
- Alert on AdFind, PsExec, Plink and encoded PowerShell outside approved admin hosts.
- Monitor ntds.dit access and shadow copy creation on domain controllers.
- Close internet-facing RDP and enforce MFA on remote access.
- Warn HR and recruiting-facing staff about job lures that ask them to download files.
- Inventory and monitor payment page scripts if you take cards online.
Standards and references
- MITRE ATT&CK: FIN6 (G0037)
- MITRE ATT&CK: OS Credential Dumping: NTDS
- Mandiant: Pick-Six: Intercepting a FIN6 Intrusion
- IBM X-Force: More_eggs, Anyone? Threat Actor ITG08 Strikes Again
- IBM X-Force: ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Threat Actor Groups Guide · Client-Side Security Guide · Active Directory Domain Compromise Response Playbook · BloodHound and Active Directory Attack Path Guide · Cybersecurity for Retail and Ecommerce Guide