FIN6

FIN6, also known as ITG08, Skelaton Spider, and MageCart, is a notorious threat actor group associated with significant cyber-attacks. The group initially gained notoriety for successfully stealing credit cards through point of sale (POS) systems in retail and hospitality establishments, notably causing the Home Depot data breach in 2015 that exposed customer credit cards in over 2000 stores, costing nearly $40 million in lawsuits and settlements. In 2018, FIN6 evolved its tactics to include ransomware. Visa attributed the use of a backdoor to FIN6 in attacks that took place in 2018, and more evidence of FIN6's fingerprints was found on TrickBot malware. The group has been linked to several other threat actors and malware services. In particular, it has ties to the Russian Cobalt Group and uses the More_eggs (or Golden Chickens) malware-as-a-service (MaaS), known as the “cyber weapon of choice” by these groups. This MaaS was provided by a Romanian man known as VENOM SPIDER, who was unmasked by eSentire. Furthermore, FIN6 has been associated with TA4557, another threat actor whose activity overlaps with other groups using More_eggs. In recent years, FIN6 has shifted its tactics from posing as fake recruiters to masquerading as fake job applicants, targeting job seekers in an attempt to infiltrate their systems. The group has also targeted critical Active Directory assets, such as the Windows NT Directory Services (NTDS.dit) file, the KRBTGT service account, and Active Directory certificates. As a result, cybersecurity firms have urged companies to update their user awareness training to mitigate the threat posed by these sophisticated, financially motivated attackers.