Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk
and LockerGoga Ransomware[html]
Summary
Recently, FireEye Managed Defense detected and responded to a FIN6
intrusion at a customer within the engineering industry, which seemed
out of character due to FIN6’s historical targeting of payment card
data. The intent of the intrusion was initially unclear because the
customer did not have or process payment card data. Fortunately, every
investigation conducted by Managed Defense or Mandiant includes
analysts from our FireEye Advanced Practices team who help correlate
activity observed in our hundreds of investigations and voluminous
threat intelligence holdings. Our team quickly linked this activity
with some recent Mandiant investigations and enabled us to determine
that FIN6 has expanded their criminal enterprise to deploy ransomware
in an attempt to further monetize their access to compromised entities.
This blog post details the latest FIN6 tactics, techniques, and
procedures (TTPs), including ties to the use of LockerGoga and Ryuk
ransomware families. It also highlights how early detection and
response combined with threat intelligence gives Managed Defense
customers a decisive advantage in stopping intruders before their
goals manifest. In this instance, Managed Defense thwarted a
potentially destructive attack that could have cost our customer
millions
