RawPOS

MITRE ATT&CK: S0169 View on attack.mitre.org

Aliases: FIENDCRY, DUEBREW, DRIFTWOOD, RawPOS

First seen
2008-01-01 00:00:00
Malware type
credential-stealer
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 15:45:23

Targeted industries: retail-and-hospitality

Context

RawPOS is a point-of-sale (POS) malware family that searches for cardholder data on victims. It has been in use since at least 2008. FireEye divides RawPOS into three components: FIENDCRY, DUEBREW, and DRIFTWOOD.

Detection coverage

  • 1 YARA rules
  • 55 Sigma rules

Malware & tools used

  • Masquerade Task or Service (attack-pattern)
  • Archive via Custom Method (attack-pattern)
  • Data from Local System (attack-pattern)
  • Local Data Staging (attack-pattern)
  • Windows Service (attack-pattern)

Used by threat actors

  • FIN5 (threat-actor)

Detection rules

  • MALPEDIA_Win_Rawpos_Auto (yara-rule)

Reports & references

  • darkreading.com — 1322645 (report)
  • youtube.com — Watch (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Rawpos (report)
  • Trend Micro — Rawpos New Behavior Risks Identity Theft (report)
  • threatvector.cylance.com — Rawpos Malware (report)
  • Trend Micro — Rawpos%20Technical%20Brief (report)
  • MITRE ATT&CK — S0169 (report)
  • github.com — Mempdump (report)
  • usa.visa.com — Alert Rawpos (report)
  • kroll.com — Malware Analysis Report Rawpos Malware (report)

External references