FrameworkPOS
FrameworkPOS is point-of-sale malware used to steal payment card track data from infected systems. The provided content states that it can collect credit card data elements from process memory, identify payment card track data on the victim, and copy the harvested data to a local file in a subdirectory of C:\Windows. It is associated with FIN6, which CrowdStrike tracks as SKELETON SPIDER, and was described in incident response reporting as being used to steal credit card track data from PoS devices. The content also notes that FIN6 has used scheduled tasks to establish persistence for FrameworkPOS and that FrameworkPOS has been used alongside Cobalt Strike. High-confidence behaviors directly mentioned include memory scraping for card data, local staging of stolen track data under C:\Windows, and use in financially motivated intrusions targeting PoS environments.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
4 techniques
Execution
MITRE ATT&CK Mapping ... Adbhoney (ADB attacks): ... T1047 — Process Execution. ... Dionaea (malware capture): ... T1047 — Process Execution.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
Persistence
2 techniques
Persistence
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
Privilege Escalation
2 techniques
Privilege Escalation
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
Stealth
1 technique
Stealth
Credential Access
1 technique
Credential Access
The content references collection of credential material from local systems, including "Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies," "GALLIUM collected ... password hashes from the SAM hive in the Registry," and "Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors."
Discovery
1 technique
Discovery
Collection
4 techniques
Collection
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
Command and Control
1 technique
Command and Control
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android/IoT cryptomining malware that installs and launches an APK and helper binaries to mine cryptocurrency on compromised devices, effectively enrolling them into a botnet.
A ransomware family cited as inspiration for GenieLocker's encryption scheme.
Referenced as a ransomware family whose cryptographic scheme and approaches were borrowed by GenieLocker.
Point-of-sale malware that indiscriminately scraped all processes on a device for payment card data, contrasted in the content with the more targeted PoSlurp.B approach.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.