{
  "id": "fin6",
  "name": "FIN6",
  "aliases": [
    "Magecart Group 6",
    "ITG08",
    "Skeleton Spider",
    "TAAL",
    "Camouflage Tempest"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Cybercriminal group",
      "src": [
        "mitre-g0037"
      ],
      "conf": "medium"
    },
    {
      "k": "attack_id",
      "v": "G0037",
      "src": [
        "mitre-g0037"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.",
      "src": [
        "mitre-g0037"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 40,
      "src": [
        "mitre-g0037"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "AdFind, Cobalt Strike, FlawedAmmyy, FrameworkPOS, GrimAgent, LockerGoga, Maze, Mimikatz, More_eggs, PsExec, Ryuk, Windows Credential Editor",
      "src": [
        "mitre-g0037"
      ],
      "conf": "high",
      "note": "12 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0037)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/fin6.html",
  "sources": {
    "mitre-g0037": {
      "title": "FIN6, Group G0037",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0037/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}