^[3]

^[4]

^[5]

^[6]

^[6]

FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.^[2]

FIN6 has used Metasploit’sPsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.^[1]

Following data collection,FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.^[1]

FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.^[1][7]

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.^[1][7]

FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.^[1]

FIN6 has extracted password hashes from ntds.dit to crack offline.^[1]

FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.^[1][2]

FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.^[1][2][8]

FIN6 has usedkill.bat script to disable security tools.^[2]

FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.^[7]

FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.^[8]

FIN6 has used the Stealer One credential stealer to target web browsers.^[8]

FIN6 has collected schemas and user accounts from systems running SQL Server.^[8]

FIN6 has collected and exfiltrated payment card data from compromised systems.^[7][9][10]

FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.^[1]

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.^[1]

FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.^[7]

FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.^[1]

FIN6 has deployed a utility script namedkill.bat to disable anti-virus.^[2]

FIN6 has removed files from victim machines.^[1]

FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.^[2]

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.^[1]

FIN6 has used Metasploit Bind and Reverse TCP stagers.^[7]

FIN6 has used encoded PowerShell commands.^[8]

FIN6 has obtained and used tools such asMimikatz,Cobalt Strike, andAdFind.^[4][2]

FIN6 has usedWindows Credential Editor for credential dumping.^[1][2]

FIN6 has used Metasploit’sPsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.^[1][2]

FIN6 has targeted victims with e-mails containing malicious attachments.^[8]

FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.^[4]

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.^[1]

FIN6 used RDP to move laterally in victim networks.^[1][2]

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.^[1]

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD andFrameworkPOS.^[1]

FIN6 has used Comodo code-signing certificates.^[4]

FIN6 has created Windows services to execute encoded PowerShell commands.^[2]

FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.^[8]

To move laterally on a victim network,FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.^[1][2][8]

FIN6 has used Pastebin and Google Storage to host content for their operations.^[2]

FIN6 has used WMI to automate the remote execution of PowerShell scripts.^[4]