FIN6

FIN6 is a financially motivated threat actor also referenced in the provided content by the aliases Camouflage Tempest, Golden Chickens, Gold Franklin, ITG08, Magecart Group 6, Skeleton Spider, Storm-0538, TA4557, TAAL, and Venom Spider. The content describes FIN6 as targeting payment card data, including collecting and exfiltrating payment card data from compromised systems and using malicious JavaScript to steal payment card data from e-commerce sites. Reported tradecraft includes use of Registry Run keys and scheduled tasks for persistence for downloader tools HARDTACK and SHIPBREAD and FrameworkPOS; PowerShell for access into merchant networks and for downloading and executing shellcode; WMI to automate remote execution of PowerShell scripts; Plink to create SSH tunnels to command-and-control servers; scripting to iterate through compromised point-of-sale systems, copy data to log files, and remove original data files; use of tools such as Mimikatz, Cobalt Strike, AdFind, and Stealer One; targeting of email, file transfer utilities including FTP, and web browsers for credential theft; disabling security tools with a kill.bat script; compressing data on remote systems and moving it to staging systems before exfiltration; removing files from victim machines; and delivering malicious attachments by email. Additional reporting in the provided content notes FIN6 used public tools including osql.exe to map internal networks and conduct reconnaissance against Active Directory, SQL servers, and NetBIOS; used RDP for lateral movement; and used Windows Credential Editor and Metasploit's PsExec NTDSGRAB module to obtain a copy of a victim Active Directory database.