Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · FIN6 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

FIN6

  • SKELETON SPIDER
  • ITG08
  • MageCart Group 6
  • White Giant
  • GOLD FRANKLIN
  • ATK88
  • G0037
  • Camouflage Tempest

MITRE G0037 ↗

FIN6 — ATT&CK roseFI

attack rose · 40 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE3 new CVEs: CVE-2010-4398, CVE-2011-2005, CVE-2013-3660

Analyst brief

misp-galaxy + mitre-attack

FIN is a group targeting financial assets including assets able to do financial transaction including PoS.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

40 techniques · 13 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    2 techniques

  3. Execution

    8 techniques

  4. Persistence

    1 technique

  5. Privilege escalation

    1 technique

  6. Stealth

    5 techniques

  7. Defense impairment

    2 techniques

  8. Credential access

    5 techniques

  9. Discovery

    3 techniques

  10. Lateral movement

    1 technique

  11. Collection

    6 techniques

  12. Command and control

    4 techniques

  13. Exfiltration

    1 technique

select a technique

Arsenal

8 malware · 4 tools
Malware
Malware · 8ATT&CK
FlawedAmmyyS0381 ↗
GrimAgentS0632 ↗
FrameworkPOSS0503 ↗
More_eggsS0284 ↗
Cobalt StrikeS0154 ↗
MazeS0449 ↗
LockerGogaS0372 ↗
RyukS0446 ↗
Tools
Tools · 4ATT&CK
Windows Credential EditorS0005 ↗
AdFindS0552 ↗
PsExecS0029 ↗
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs FIN6 is cited as exploiting

none on KEV
  1. CVE-2010-43982026-10-17
    1. “FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2011-20052026-10-17
    1. “FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2013-36602026-10-17
    1. “FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

14 sources
  1. 1.www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf
  2. 2.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-f…
  3. 3.attack.mitre.org/groups/G0037
  4. 4.securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again
  5. 5.secureworks.com/research/threat-profiles/gold-franklin
  6. 6.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report
  7. 7.proofpoint.com/us/blog/threat-insight/security-brief-ta4557-targets-r…
  8. 8.proofpoint.com/us/threat-insight/post/fake-jobs-campaigns-delivering-…
  9. 9.cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-a…
  10. 10.attack.mitre.org/groups/G0037
  11. +4 more in the JSON record

Track FIN6 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.