FIN6

Introduction

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors. FireEye FIN6 April 2016 FireEye FIN6 Apr 2019

Activities and Tactics

Country of Origin: 🇷🇺 Russia

First Seen: 2018

Last Activity: 2018

Notable Campaigns

• 2018
• 2019-01
• 2019-03
• 2019-04
• 2019-08
• 2019-09
• 2020-03
• Altran decided to shut down its network and applications.
• Based on Visa Payment Fraud Disruption’s (PFD) analysis of eCommerce compromises throughout 2018
• Based on our investigation and analysis of its adversarial tactics
• FIN6’s focus on the CNP environment has only amplified
• Hackers have breached the infrastructure of Volusion
• Hackers have infected the systems of Altran Technologies with malware that spread through the company network
• Hexion/Momentive (a chemical manufacturer)
• IBM X-Force Incident Response and Intelligence Services (IRIS) research believes that the elite cybercriminal threat actor ITG08
• In a new and dangerous twist to this trend
• Morphisec has been tracking multiple sophisticated attacks targeting Point of Sale thin clients globally. More specifically
• Norsk Hydro
• One of the largest aluminum producers in the world
• Over the past 8-10 weeks
• The Securonix Threat Research Team has been closely monitoring the LockerGoga targeted cyber sabotage/ransomware (TC/R) attacks impacting Norsk Hydro (one of the largest aluminum companies worldwide)
• a provider of cloud-hosted online stores
• affecting operations in some European countries. To protect client data and their own assets
• also known as FIN6
• and are delivering malicious code that records and steals payment card details entered by users in online forms.
• and other companies’ IT and operational technology (OT) infrastructure
• causing over US$40 million in damages.
• has been forced to switch to partial manual operations due to a cyber attack that is allegedly pushing LockerGoga ransomware.
• has partnered with the malware gang behind one of the most active Trojans — TrickBot — to use TrickBot’s new malware framework dubbed “Anchor” against organizations for financial profit.
• http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems
• https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/
• https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/
• https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf
• https://www.bleepingcomputer.com/news/security/lockergoga-ransomware-sends-norsk-hydro-into-manual-mode/
• https://www.bleepingcomputer.com/news/security/new-lockergoga-ransomware-allegedly-used-in-altran-attack/
• https://www.securonix.com/securonix-threat-research-detecting-lockergoga-targeted-it-ot-cyber-sabotage-ransomware-attacks/
• https://www.zdnet.com/article/card-data-from-the-volusion-web-skimmer-incident-surfaces-on-the-dark-web/
• https://www.zdnet.com/article/hackers-breach-volusion-and-start-collecting-card-details-from-thousands-of-sites/
• on the 6th of February we identified an extremely high number of prevention events stopping Cobalt Strike backdoor execution
• suggesting that the cybercrime group has fully incorporated targeting CNP environments into their criminal methodology.
• targeting specific employees with spear phishing emails advertising fake job advertisements and repeatedly deploying the More_eggs Jscript backdoor malware.
• techniques and procedures (TTPs)
• we believe ITG08 is actively attacking multinational organizations
• with some of the attacks expressly targeting Point of Sale VMWare Horizon thin clients.

Tactics, Techniques, and Procedures (TTPs)

• T1560.003 Archive via Custom Method
• T1566.001 Spearphishing Attachment
• T1685 Disable or Modify Tools
• T1087.002 Domain Account
• T1059 Command and Scripting Interpreter
• T1572 Protocol Tunneling
• T1213.006 Databases
• T1027.010 Command Obfuscation
• T1059.007 JavaScript
• T1102 Web Service
• T1005 Data from Local System
• T1547.001 Registry Run Keys / Startup Folder
• T1059.003 Windows Command Shell
• T1588.002 Tool
• T1070.004 File Deletion
• T1003.003 NTDS
• T1134 Access Token Manipulation
• T1068 Exploitation for Privilege Escalation
• T1204.002 Malicious File
• T1036.004 Masquerade Task or Service
• T1566.003 Spearphishing via Service
• T1059.001 PowerShell
• T1560 Archive Collected Data
• T1553.002 Code Signing
• T1021.001 Remote Desktop Protocol
• T1119 Automated Collection
• T1018 Remote System Discovery
• T1053.005 Scheduled Task
• T1569.002 Service Execution
• T1046 Network Service Discovery
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1047 Windows Management Instrumentation
• T1110.002 Password Cracking
• T1555 Credentials from Password Stores
• T1095 Non-Application Layer Protocol
• T1078 Valid Accounts
• T1573.002 Asymmetric Cryptography
• T1003.001 LSASS Memory
• T1555.003 Credentials from Web Browsers
• T1074.002 Remote Data Staging

ATT&CK technique IDs (denormalized)

• T1003.001
• T1003.003
• T1005
• T1018
• T1021.001
• T1027.010
• T1036.004
• T1046
• T1047
• T1048.003
• T1053.005
• T1059
• T1059.001
• T1059.003
• T1059.007
• T1068
• T1070.004
• T1074.002
• T1078
• T1087.002
• T1095
• T1102
• T1110.002
• T1119
• T1134
• T1204.002
• T1213.006
• T1547.001
• T1553.002
• T1555
• T1555.003
• T1560
• T1560.003
• T1566.001
• T1566.003
• T1569.002
• T1572
• T1573.002
• T1588.002
• T1685

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

• FrameworkPoS:
• Vawtrak/Neverquest:
• Ransomware:
• AbaddonPOS:
• Anchor:
• BlackPOS:
• CmdSQL:
• Cobalt Strike:
• FlawedAmmyy:
• Grateful POS:
• JSPSPY:
• Living off the Land:
• LockerGoga:
• Magecart:
• Meterpreter:
• Mimikatz:
• More_eggs:
• Ryuk:
• SCRAPMINT:
• TerraStealer:
• Vawtrak:
• Windows Credentials Editor:

MITRE ATT&CK Software

• FlawedAmmyy (S0381) — malware
• GrimAgent (S0632) — malware
• FrameworkPOS (S0503) — malware
• More_eggs (S0284) — malware
• Cobalt Strike (S0154) — malware
• Windows Credential Editor (S0005) — tool
• AdFind (S0552) — tool
• PsExec (S0029) — tool
• Maze (S0449) — malware
• LockerGoga (S0372) — malware
• Ryuk (S0446) — malware
• Mimikatz (S0002) — tool

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

[1] mitre-attack [8] Crowdstrike Global Threat Report Feb 2018 CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018. [9] FireEye FIN6 April 2016 FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024. [10] FireEye FIN6 Apr 2019 McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. [11] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [12] Security Intelligence ITG08 April 2020 Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020. [13] Security Intelligence More Eggs Aug 2019 Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.