Wiki › Adversaries & Campaigns › Cybercrime Groups › FIN10

FIN10

1 min read

Jump to:

Summary

FIN10 is a financially motivated cybercriminal group known for targeting organizations through sophisticated application attacks, primarily focusing on stealing payment card data and sensitive financial information. The group employs a variety of malware and exploitation techniques to infiltrate networks, maintain persistence, and exfiltrate valuable data, often targeting point-of-sale (POS) systems and related infrastructure.

Key Characteristics

Use of custom malware and tools designed to scrape memory and capture payment card data from POS systems.
Exploitation of vulnerabilities in enterprise applications and network infrastructure to gain initial access.
Deployment of obfuscation and evasion techniques to avoid detection by security solutions.
Focus on lateral movement within compromised networks to access critical financial systems.
Exfiltration of stolen data through encrypted channels to evade network monitoring.
Targeting of retail, hospitality, and financial sectors with high-value transactional data.

Defensive Controls

Implementing endpoint detection and response (EDR) solutions to identify and block malware activity.
Regularly patching and updating POS systems and associated software to mitigate known vulnerabilities.
Segmenting networks to limit lateral movement and restrict access to sensitive financial systems.
Monitoring network traffic for unusual patterns indicative of data exfiltration.
Employing multi-factor authentication (MFA) to secure access to critical applications and systems.
Conducting regular security awareness training to recognize phishing and social engineering attempts.

FIN10

Summary

Key Characteristics

Defensive Controls

Related Security Solutions