FIN6 (TAAL) — ATT&CK profile, 40 techniques

Overview

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.

Naming & attribution

FIN6 is tracked under 6 names across the industry. It uses 40 documented ATT&CK techniques — more than 74% of the 174 groups tracked here.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Magecart Group 6	Villadsen, O
ITG08	Villadsen, O.
Skeleton Spider	CrowdStrike
TAAL	Microsoft
Camouflage Tempest	Microsoft
FIN6	FireEye Threat Intelligence

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1134 Access Token Manipulation — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

FIN8 — 18 shared techniques (31% overlap)
Silence — 16 shared techniques (31% overlap)
menuPass China — 19 shared techniques (28% overlap)
Wizard Spider Russia — 22 shared techniques (27% overlap)
OilRig Iran — 24 shared techniques (26% overlap)
Fox Kitten Iran — 16 shared techniques (25% overlap)

Malware families with tracked indicators

One family attributed to FIN6, with 3 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

Maze3 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Capabilities

Custom malware/implant development — ATT&CK: 8 attributed custom malware families

TTPs — 40 techniques across 13 tactics

Resource Development

T1588.002Tool

Stealth

Defense Impairment

T1553.002Code Signing
T1685Disable or Modify Tools

Credential Access

T1003.001LSASS Memory
T1003.003NTDS
T1110.002Password Cracking
T1555Credentials from Password Stores
T1555.003Credentials from Web Browsers

Discovery

Lateral Movement

T1021.001Remote Desktop Protocol

Collection

Command and Control

Exfiltration

T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

Tools & malware (12)

FlawedAmmyy · GrimAgent · FrameworkPOS · More_eggs · Cobalt Strike · Windows Credential Editor · AdFind · PsExec · Maze · LockerGoga · Ryuk · Mimikatz

Reporting (3)

How Microsoft names threat actors — Microsoft
ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework — Villadsen, O
More_eggs, Anyone? Threat Actor ITG08 Strikes Again — Villadsen, O.