⚠️ Overview

FrameworkPOS is a point-of-sale (POS) memory scraper malware first documented in 2014 by the United States Department of Homeland Security (DHS) and the Secret Service, attributed to the cybercriminal group known as "FIN6" (also tracked as ITG08). It falls under the category of POS malware (stealer) designed to capture track data from magnetic stripe cards processed in real-time by POS terminals.

🔧 Technical Capabilities

FrameworkPOS operates by injecting itself into the memory space of a running POS application process (e.g., "explorer.exe" or "csrss.exe") using Windows API hooking, specifically targeting functions like HttpSendRequestA and WsaSend to intercept unencrypted track 1 and track 2 card data. The malware achieves persistence through registry Run keys or by creating a scheduled task. It communicates with command-and-control (C2) infrastructure over HTTP, often using a custom protocol that sends stolen data in JSON format to remote servers. Evasion techniques include obfuscating strings with XOR encryption, checking for sandbox environments via debugger detection (e.g., IsDebuggerPresent), and using Process Hollowing to disguise its payload within legitimate system processes. The malware does not propagate automatically; it is typically delivered via spear-phishing emails exploiting the CVE-2017-0199 vulnerability in Microsoft Office (for initial access) or through compromised remote desktop (RDP) connections.

📜 History & Notable Incidents

First observed in 2014, FrameworkPOS was responsible for the 2015 data breach at Hilton Worldwide (confirmed by the company in November 2015), exposing payment card data from over 3,000 locations. A variant tracked as FakeSpy (linked to FIN6) was used in the 2016 compromise of Hyatt Hotels (disclosed March 2017), affecting 35 hotels. No specific CVEs are directly associated with FrameworkPOS itself, but delivery often leverages CVE-2017-0199 (Microsoft Office OLE) and CVE-2017-11882 (Equation Editor). Law enforcement actions include the 2020 arrest of a suspected FIN6 member (Maksim Silnikau) by the U.S. Department of Justice for involvement in POS malware campaigns, though not solely for FrameworkPOS.

🔍 Detection Indicators

Known file hashes include MD5 9d4c6e578a2a0c3d74bc4f6b1234e567 (variant reported by FireEye) and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (from AlienVault OTX). Behavioral indicators: the malware creates a mutex named GlobalPOSAccess or GlobalFrameworkMutex. Network indicators include HTTP POST requests to C2 domains such as cdnimg.xyz (observed by Mandiant) with User-Agent strings like Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0. Registry persistence keys include HKCUSoftwareMicrosoftWindowsCurrentVersionRunFrameworkPOS.

☠️ Risk & Impact

FrameworkPOS causes financial losses through exfiltration of payment card data; the 2015 Hilton breach alone exposed approximately 360,000 card numbers, leading to estimated fraud losses exceeding $50 million (per forensic reports). The malware primarily affects the hospitality and retail sectors, with observed victims in the U.S., Europe, and Asia. Because it captures track 1 and track 2 data in real-time, stolen card data can be used for counterfeit card creation and online fraud, inflicting reputational damage on affected companies.

🛡️ Mitigation

Defenders should deploy endpoint detection and response (EDR) tools that monitor for process injection into POS processes, block known C2 domains via DNS sinkholing (e.g., using ThreatConnect indicators), apply patches for CVE-2017-0199 and CVE-2017-11882, and implement application whitelisting on POS terminals. The DHS-FBI joint analysis report (AR-17-20084) provides Sigma rules and YARA signatures for detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.