FIN6
IntrusionSet · ATTACK:ics:G0037
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:G0037",
"title": "FIN6",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0037",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb",
"external_id": "G0037",
"domain": "ics",
"created": "2017-05-31T21:32:06.015Z",
"modified": "2026-07-31T20:48:30.435Z",
"version": "4.0",
"aliases": [
"FIN6",
"Magecart Group 6",
"ITG08",
"Skeleton Spider",
"TAAL",
"Camouflage Tempest"
],
"tactics": [
],
"source_references": [
{
"source_name": "Skeleton Spider"
},
{
"source_name": "FIN6"
},
{
"source_name": "TAAL"
},
{
"source_name": "Camouflage Tempest"
},
{
"source_name": "Magecart Group 6"
},
{
"source_name": "ITG08"
},
{
"source_name": "Crowdstrike Global Threat Report Feb 2018",
"url": "https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report"
},
{
"source_name": "FireEye FIN6 April 2016",
"url": "https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"
},
{
"source_name": "FireEye FIN6 Apr 2019",
"url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Security Intelligence ITG08 April 2020",
"url": "https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/"
},
{
"source_name": "Security Intelligence More Eggs Aug 2019",
"url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
}
]
}Explicit source assertions (2)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:G0037 → uses → ATTACK:ics:S0372
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad7770c3-fe24-4285-9ce2-1616a1061472
FireEye FIN6 Apr 2019ATTACK:ics:G0037 → uses → ATTACK:ics:S0446
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9f5096e-b9fc-459a-a303-88763b1269cc
FireEye FIN6 Apr 2019