The story of FIN6 shows how real-world threat actors operate, providing a glimpse not only into the technical details of the compromise, but also into the human factor as well; namely, the interactions between different criminals or criminal groups, and how it is not just data being bartered or sold in the underground, but also tools, credentials and access. In this case, the combined intelligence from the FireEye, Mandiant and iSIGHT intelligence teams was able to not only identify malicious activity aimed at stealing payment card data, but also provide a detailed window into that activity from compromise through monetization of the stolen data.