FIN6 is a financially motivated cybercriminal group active since at least 2012 (sometimes cited as 2015), initially notorious for targeting point-of-sale (POS) systems in the retail and hospitality sectors to steal payment card data for resale on underground markets. Over time, the group expanded its operations to include e-commerce skimming, ransomware (including ties to Ryuk and Lockergoga), and, most recently, advanced social engineering campaigns targeting corporate HR and recruiting workflows.