MITRE ATT&CK / Software / S0169

RawPOS

ID
S0169
Type
Malware
Associated names
FIENDCRY, DUEBREW, DRIFTWOOD
Platforms
Windows
Source
attack.mitre.org
MITRE last modified
25 Apr 2025

RawPOS is a point-of-sale (POS) malware family that searches for cardholder data on victims. It has been in use since at least 2008. [1] [2] [3] FireEye divides RawPOS into three components: FIENDCRY, DUEBREW, and DRIFTWOOD. [4] [5]

Techniques used (5)

Groups using it (1)

References

  1. Kroll RawPOS Jan 2017
  2. TrendMicro RawPOS April 2015
  3. Visa RawPOS March 2015
  4. Mandiant FIN5 GrrCON Oct 2016
  5. DarkReading FireEye FIN5 Oct 2015