The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
FIN6 is a financially motivated criminal group that compromised retail and hospitality point-of-sale (PoS) environments, harvested payment-card data, and sold it through underground markets. FireEye reported in 2016 that more than 10 million FIN6-linked cards appeared in one underground card shop, with victim data visible there as far back as 2014. The group later added e-commerce checkout skimming and, according to Mandiant in 2019, ransomware as additional ways to monetize access.
What is FIN6?
MITRE ATT&CK identifies FIN6 as group G0037, a financially motivated cybercrime operation associated with Magecart Group 6, ITG08, Skeleton Spider, TAAL and Camouflage Tempest. Its core business was stealing payment-card data and selling it for profit. MITRE describes FIN6 as aggressively compromising PoS systems in the hospitality and retail sectors.
“FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces.” — MITRE ATT&CK, FIN6 group page
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
The number associated with FIN6 is unusually large but needs context. FireEye Threat Intelligence reported in 2016 that more than 10 million cards from some FIN6-linked breaches had been identified on an underground card shop. That figure describes cards listed or identified in the marketplace, not a verified count from one incident or proof that every card was stolen in a single operation.
#1 Best Overall
- With Square Terminal, you can ring up sales, accept payments, and print receipts, all with one device. Use it at the counter or ring up customers anywhere in your store.
- Accept all major credit and debit cards and pay one low rate with no hidden fees and no long-term contracts.
- Process chip cards in just two seconds.
- Get your money as soon as the next business day.
- Use it cordlessly with the built-in battery, designed to last all day.
How FIN6’s PoS operation worked
1. Obtaining access and moving through the network
MITRE procedure examples show FIN6 using valid accounts, exploiting systems for privilege escalation, and performing network and service discovery. The group also used Windows services and remote services to move between machines. In practice, a compromised credential or exposed system could become a route into the payment environment rather than the final target.
2. Collecting card data on PoS systems
Once PoS systems were under control, FIN6 used scripts and malware to collect payment-card data from them. Visa’s February 2019 payment-fraud report names TRINITY, also called FrameworkPOS, in FIN6 PoS compromises. PoS malware commonly targets card data while it is being handled by the payment application, making the payment terminal itself the high-value collection point.
Rank #2
- Get your money as soon as the next business day.
- Get set up quickly with no long-term commitments. Download the Square Point of Sale app for free, create an account, and start taking payments anywhere.
- Run your business all in one place with the free Square Point of Sale app. Track your sales, manage inventory, accept tips, send receipts digitally, and more.
- Works with Apple devices with a Lightning connector.
3. Staging and exfiltrating the harvest
MITRE records FIN6 compressing collected data, placing it in remote staging locations, and sending it out through HTTP POST requests. Compression and staging can reduce the number of files an operator must move and make a large theft look like ordinary web traffic unless outbound destinations, timing and volume are monitored.
4. Selling the data
FireEye traced FIN6-linked victim data to an underground card shop. Its 2016 reporting said listings sometimes exceeded 10 million cards and that the shop contained FIN6-linked data dating to at least 2014. The criminal value came from reselling usable card details, not from disrupting the merchant’s checkout operation.
Rank #3
- MSR90 is a USB emulation keyboard interface that not need any driver or software,USB simply plug and play
- Reads up to 3 tracks of information,can reads ISO7811, AAMVA, CA DMV and most other card data formats
- Threaded inserts for mounting. LED indicator, green light is on when connecting,green light blinks when cards swiped
- Bi-directional swipe reading, superior reading of high jitter, scratched, and worn magstripe cards, reliable for over 1,000,000 card swipes
- Configuration software makes configuration changes easy,works with: Windows OS and Mac OS
Did FIN6 move from PoS attacks to e-commerce skimming?
Yes. Visa documented a fallback and expansion path in February 2019: when FIN6 could not deploy PoS malware, investigators observed the group injecting malicious code into e-commerce checkout pages to capture card-not-present (CNP) data.
Visa wrote that FIN6 “has fully incorporated targeting CNP environments into their criminal methodology.” — Visa Payment Fraud Disruption, February 2019
Rank #4
ETEKJOY USB 3-Track Magnetic Stripe Card Reader POS Credit Card Reader Swiper MagStripe Swipe Card Reader ET-MSR90
- USB interface, keyboard emulation, no need to install software to read, configuration software for changing settings available.
- Read data from all 3 tracks, high and low coercivity cards, ISO7811, AAMVA, CA DMV and most magnetic card data formats.
- Work on Windows, Mac and other USB capable systems. Work with TXT, notepad, Word, Excel, POS systems and son on.
- Compact size, with 145cm USB cord, two 3mm-diameter screw holes for fixing at the bottom, a LED indicator light
- Perfect for POS, Banking, Loyalty, Access Control, ID verification and other applications.
In a web-skimming attack, the valuable asset is the checkout page and its JavaScript supply chain rather than a payment terminal. An injected script can read fields as a customer submits them and transmit the values to an attacker-controlled destination. That means a merchant can have clean-looking PoS terminals while its online store is leaking payment data.
Recommended Free Tools
Is FIN6 connected to ransomware?
Yes, but ransomware was an expansion of FIN6’s monetization strategy rather than the original PoS-only model. On April 4, 2019, Mandiant reported that FIN6 had begun deploying ransomware to monetize access to organizations that did not hold useful payment-card data. This gave the group a way to profit from an intrusion even when card theft was impractical.
Best Value
- Pay one transparent rate per swipe for Visa, Mastercard, Discover and American Express.
- Works in conjunction with most downloadable Square point-of-sale apps on your device. Customers can pay, tip and sign directly on your device. Track payments in cash, gift cards and more. Also lets you send receipts via e-mail or text message, makes it easy to apply discounts, keeps a data and sales history log and more.
- Accepts magstripe credit card payments, including those from Visa, Mastercard, Discover and American Express (fees apply).
- App sends deposits to your bank account within 1 to 2 business days, or enjoy instant deposits (fees apply).
PoS compromise versus e-commerce JavaScript skimming
| Attribute | PoS memory or system compromise | E-commerce JavaScript skimming |
|---|---|---|
| Primary target | Retail or hospitality payment terminals and supporting systems | Online checkout pages, scripts or their hosting and delivery paths |
| Data type | Payment-card data handled by the PoS application | Card-not-present data entered during an online purchase |
| Named FIN6 malware or method | TRINITY, also called FrameworkPOS, plus scripts and other collection malware | Injected malicious checkout code observed when PoS deployment was blocked |
| Useful defensive focus | Network segmentation, credential protection, endpoint detection and restricted remote administration | Checkout-code integrity monitoring, script inventory and alerts for unauthorized changes or data destinations |
| Typical exfiltration concern | Staged files and outbound HTTP POST traffic from the payment environment | Browser-side requests carrying form data to an unapproved endpoint |
Card-shop sales versus ransomware monetization
| Monetization route | What FIN6 monetizes | Documented evidence | Operational consequence for victims |
|---|---|---|---|
| Underground card shop | Stolen payment-card records resold to other criminals | FireEye’s 2016 report described more than 10 million FIN6-linked cards identified on a card shop and records dating to at least 2014 | Fraud exposure can continue after the merchant removes the malware because copied card data may already be circulating |
| Ransomware | Access to an organization and its ability to resume operations | Mandiant reported on April 4, 2019 that FIN6 used ransomware against organizations without useful payment-card data | An intrusion can become an availability and extortion crisis even when no card database is present |
Defensive controls for merchants
The controls below map directly to FIN6 behaviors documented by MITRE, Visa and Mandiant. They are complementary: protecting only the PoS subnet does not protect an online checkout, and monitoring only malware does not detect stolen credentials.
Segment and restrict the payment environment
- Place PoS systems in tightly controlled network segments separated from ordinary user devices and corporate services.
- Limit Windows services, remote services and administrative paths to the systems and accounts that genuinely need them.
- Alert on new remote connections, unexpected service creation and discovery activity inside the payment segment.
Protect privileged credentials
- Use separate, least-privilege administrative accounts for payment systems; do not reuse them across stores or unrelated servers.
- Require strong authentication for administrative access, rotate credentials after suspected exposure, and monitor use of valid accounts from unusual hosts or times.
- Investigate credential theft indicators before treating a PoS malware alert as an isolated endpoint problem.
Detect endpoint and collection activity
- Deploy endpoint detection and response where the PoS platform supports it, with attention to PowerShell, Cobalt Strike, archive creation, discovery commands and attempts to disable antivirus.
- Monitor for scripts or processes reading payment applications or memory, creating compressed staging files, or making unusual outbound HTTP POST requests.
- Preserve endpoint and network telemetry long enough to reconstruct the initial access, lateral movement and exfiltration path.
Protect checkout-page integrity
- Maintain an inventory of every script loaded by the checkout page and alert on additions, substitutions or changes outside the release process.
- Use application-integrity monitoring for web assets and review third-party script access to payment fields.
- Watch browser-side requests for new destinations, unusual payloads or traffic that does not match the merchant’s approved payment flow.
Prepare the response before an incident
- Keep an incident-response plan that covers both PoS and web applications, including who can isolate a terminal, suspend a compromised account and preserve evidence.
- Define escalation paths for payment-fraud, security and business-continuity teams so a suspected card-data loss is not handled as a routine malware cleanup.
- After containment, search for the same credentials, scripts, staging locations and outbound destinations across the environment; FIN6’s documented use of discovery and remote services makes single-host remediation insufficient.
What FIN6 shows about payment security
FIN6’s history is a progression from card-present theft to whichever access path produced revenue: PoS collection when payment terminals were reachable, browser skimming when online checkout was easier to compromise, and ransomware when card data was unavailable. Merchants therefore need one payment-security program that treats PoS software, checkout code, credentials, network pathways and incident response as connected assets.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
