Trusted Design

FIN6

アクターID: G0037

· MITRE Pageへのリンク

脅威アクターの詳細

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

脅威アクターの別名・別称

FIN6
Magecart Group 6
ITG08
Skeleton Spider
TAAL
Camouflage Tempest

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1047 - Windows Management Instrumentation
• T1546.013 - PowerShell Profile
• T1016.001 - Internet Connection Discovery
• T1036.005 - Match Legitimate Resource Name or Location
• T1587.001 - Malware
• T1087.002 - Domain Account
• T1063 - Security Software Discovery
• T1598.003 - Spearphishing Link
• T1487 - Disk Structure Wipe
• T1103 - AppInit DLLs
• T1587.002 - Code Signing Certificates
• T1584.003 - Virtual Private Server
• T1562 - Impair Defenses
• T1062 - Hypervisor
• T1550 - Use Alternate Authentication Material
• T1562.012 - Disable or Modify Linux Audit System
• T1546.005 - Trap
• T1055.013 - Process Doppelgänging
• T1588.001 - Malware
• T1612 - Build Image on Host
• T1497.002 - User Activity Based Checks
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1597 - Search Closed Sources
• T1157 - Dylib Hijacking
• T1039 - Data from Network Shared Drive
• T1128 - Netsh Helper DLL
• T1203 - Exploitation for Client Execution
• T1591.004 - Identify Roles
• T1601.001 - Patch System Image
• T1070.009 - Clear Persistence
• T1505 - Server Software Component
• T1134 - Access Token Manipulation
• T1209 - Time Providers
• T1622 - Debugger Evasion
• T1548.006 - TCC Manipulation
• T1027.007 - Dynamic API Resolution
• T1547.008 - LSASS Driver
• T1556 - Modify Authentication Process

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1027.007)
• CVE-2017-0143 (T1547.008)
• CVE-2014-0322 (T1027.007)
• CVE-2015-2419 (T1546.013)
• CVE-2016-0189 (T1601.001)
• CVE-2015-1770 (T1027.007)
• CVE-2015-2545 (T1027.007)
• CVE-2017-0199 (T1027.007)
• CVE-2012-0158 (T1027.007)
• CVE-2013-3906 (T1601.001)
• CVE-2014-6352 (T1027.007)
• CVE-2015-0016 (T1039)
• CVE-2010-3333 (T1209)
• CVE-2010-0188 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2011-0611 (T1547.008)
• CVE-2015-2424 (T1063)
• CVE-2014-1761 (T1598.003)
• CVE-2015-1641 (T1063)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2013-6282 (T1597)
• CVE-2013-2465 (T1547.008)
• CVE-2013-2551 (T1063)
• CVE-2013-0634 (T1547.008)
• CVE-2014-7247 (T1547.008)
• CVE-2013-0641 (T1591.004)
• CVE-2013-5990 (T1547.008)
• CVE-2025-54313 (T1063)
• CVE-2010-1553 (T1547.008)
• CVE-2015-2853 (T1598.003)
• CVE-2017-16929 (T1588.001)
• CVE-2012-1876 (T1598.003)
• CVE-2012-2539 (T1598.003)
• CVE-2013-3660 (T1039)
• CVE-2013-7331 (T1027.007)
• CVE-2009-3129 (T1547.008)
• CVE-2014-0329 (T1597)
• CVE-2015-7261 (T1562)
• CVE-2015-8286 (T1562)
• CVE-2016-2343 (T1612)
• CVE-2016-6532 (T1612)
• CVE-2016-9495 (T1562)
• CVE-2012-0507 (T1547.008)
• CVE-2014-3393 (T1547.008)
• CVE-2015-2546 (T1547.008)
• CVE-2015-3785 (T1597)
• CVE-2015-5897 (T1039)
• CVE-2015-3456 (T1157)
• CVE-2013-2094 (T1039)
• CVE-2014-4113 (T1027.007)
• CVE-2015-8562 (T1203)
• CVE-2016-1990 (T1039)
• CVE-2016-1991 (T1203)
• CVE-2015-1701 (T1027.007)
• CVE-2015-3628 (T1039)
• CVE-2015-6034 (T1039)
• CVE-2015-6022 (T1562.012)
• CVE-2015-7262 (T1039)
• CVE-2016-1562 (T1597)
• CVE-2017-0263 (T1547.008)
• CVE-2016-9496 (T1157)
• CVE-2012-0056 (T1039)
• CVE-2010-3081 (T1209)
• CVE-2012-1258 (T1209)
• CVE-2014-3153 (T1039)
• CVE-2015-3636 (T1039)
• CVE-2015-0057 (T1027.007)
• CVE-2015-1761 (T1039)
• CVE-2015-2360 (T1027.007)
• CVE-2014-6324 (T1039)
• CVE-2008-1436 (T1027.007)
• CVE-2010-0232 (T1039)
• CVE-2010-4398 (T1209)
• CVE-2014-2273 (T1597)
• CVE-2015-2387 (T1039)
• CVE-2017-0001 (T1547.008)
• CVE-2025-13335 (T1562.012)
• CVE-2025-13927 (T1157)
• CVE-2025-13928 (T1157)
• CVE-2025-24893 (T1547.008)
• CVE-2025-68645 (T1209)
• CVE-2026-1102 (T1157)
• CVE-2026-20127 (T1039)
• CVE-2012-1856 (T1027.007)
• CVE-2012-4969 (T1027.007)
• CVE-2014-4148 (T1027.007)
• CVE-2015-5477 (T1588.001)
• CVE-2012-4681 (T1039)
• CVE-2014-6271 (T1547.008)
• CVE-2016-0984 (T1039)
• CVE-2016-1287 (T1547.008)
• CVE-2016-9494 (T1039)
• CVE-2017-3212 (T1597)
• CVE-2025-55182 (T1597)
• CVE-2014-7911 (T1597)
• CVE-2014-4322 (T1039)
• CVE-2015-3105 (T1597)
• CVE-2015-0310 (T1039)
• CVE-2014-1776 (T1157)
• CVE-2014-0556 (T1547.008)
• CVE-2010-1297 (T1591.004)
• CVE-2011-3402 (T1597)
• CVE-2015-2426 (T1597)
• CVE-2012-6422 (T1547.008)
• CVE-2013-2595 (T1039)
• CVE-2012-0611 (T1039)
• CVE-2017-7255 (T1134)
• CVE-2025-34026 (T1597)
• CVE-2025-55183 (T1157)
• CVE-2025-55184 (T1597)
• CVE-2015-4495 (T1039)
• CVE-2015-7808 (T1203)
• CVE-2016-1019 (T1547.008)
• CVE-2010-0738 (T1547.008)
• CVE-2011-1255 (T1548.006)
• CVE-2023-1389 (T1547.008)
• CVE-2025-31125 (T1157)
• CVE-2015-5119 (T1039)
• CVE-2015-5122 (T1134)
• CVE-2015-7645 (T1039)
• CVE-2015-3043 (T1134)
• CVE-2015-3090 (T1547.008)
• CVE-2015-3113 (T1039)
• CVE-2015-2590 (T1039)
• CVE-2015-2502 (T1027.007)
• CVE-2016-1010 (T1547.008)
• CVE-2016-0998 (T1547.008)
• CVE-2015-0313 (T1039)
• CVE-2015-0359 (T1134)
• CVE-2015-5130 (T1547.008)
• CVE-2015-5134 (T1547.008)
• CVE-2015-5539 (T1547.008)
• CVE-2015-5557 (T1547.008)
• CVE-2015-5563 (T1547.008)
• CVE-2015-5559 (T1547.008)
• CVE-2015-5540 (T1547.008)
• CVE-2015-5561 (T1547.008)
• CVE-2015-5551 (T1547.008)
• CVE-2015-5564 (T1547.008)
• CVE-2015-5565 (T1547.008)
• CVE-2015-5550 (T1547.008)
• CVE-2015-5566 (T1547.008)
• CVE-2015-5127 (T1547.008)
• CVE-2015-5556 (T1547.008)
• CVE-2015-0311 (T1039)
• CVE-2015-0336 (T1547.008)
• CVE-2015-2854 (T1203)
• CVE-2016-1898 (T1203)
• CVE-2016-1897 (T1203)
• CVE-2010-2883 (T1209)
• CVE-2014-6332 (T1027.007)
• CVE-2014-8440 (T1134)
• CVE-2016-2342 (T1209)
• CVE-2014-8439 (T1209)
• CVE-2014-9163 (T1209)
• CVE-2010-0806 (T1209)
• CVE-2015-1427 (T1547.008)
• CVE-2016-1001 (T1547.008)
• CVE-2015-4902 (T1547.008)
• CVE-2017-8570 (T1547.008)
• CVE-2025-66478 (T1547.008)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る