Search threats, CVEs… ⌘K
← Back to all threat actors

FIN6

Also known as Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest
Tracked as G0037

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.

How we source and review actor profiles
Sectors
retail, hospitality
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
IdentityAlias: Magecart Group 6

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: ITG08

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Skeleton Spider

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: TAAL

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Camouflage Tempest

Reviewed identity mapping approved on this date.

Cataloged
IdentityTracking identifier: G0037

Reviewed identity mapping approved on this date.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

FIN6Canonical Name
Camouflage TempestAlias
ITG08Alias
Magecart Group 6Alias
Skeleton SpiderAlias
TAALAlias
G0037Tracking Id

Loading CVEs, techniques, indicators, malware, victims, and activity...