FIN6

FIN6, also known as ITG08, Skelaton Spider, and MageCart, is a notorious threat actor that has been implicated in various cybercrime activities. The group gained notoriety for stealing credit cards through point-of-sale (POS) systems in retail and hospitality establishments, most notably in the Home Depot breach in 2015 which exposed customer credit cards in over 2000 stores, costing the company nearly $40 million in lawsuits and settlements. By 2018, Visa had attributed the use of a backdoor to FIN6 in attacks on e-commerce merchants. In the same year, FIN6 appeared to pivot to include ransomware tactics in its arsenal. The group's activities are linked with several malware-as-a-service (MaaS) offerings, including more_eggs, also known as Golden Chickens, and TrickBot's Anchor Framework. More_eggs is considered the "cyber weapon of choice" by the Russia-based FIN6 and Cobalt Group cyber gangs. The identity of the malware provider was uncovered by eSentire as a Romanian man known as VENOM SPIDER. Additionally, FIN6 has been associated with TA4557, another threat actor whose activity overlaps with other groups using more_eggs, namely Cobalt Group and Evilnum. FIN6's activities have evolved over time, with the group targeting critical Active Directory assets and deploying sophisticated malware suites such as Cobalt Strike in their attacks. In 2019, eSentire noted that FIN6 leveraged a malware suite that included the PureLocker ransomware plugin. This suite was previously used by the Cobalt Group in 2017 and 2018. Furthermore, SecurityWeek reports that the developer behind the Golden Chickens malware, used by both the Russian Cobalt Group and FIN6, was identified as a Romanian named Jack, also known as Lucky and badbullzvenom.