⚠️ Overview

ModPipe is a modular backdoor trojan first documented by SentinelOne in March 2022, targeting point‑of‑sale (POS) systems in the hospitality sector, particularly Oracle MICROS platforms. The malware is attributed to a financially motivated threat group tracked as UNC1945 (also known as FIN8) by Mandiant, and it functions as an information stealer designed to exfiltrate payment card data and terminal credentials.

🔧 Technical Capabilities

ModPipe uses a dropper (typically named core.exe or load.exe) that installs a core module (mod_core) and several plug‑in modules (e.g., mod_klog, mod_fds, mod_pdown) via RC4‑encrypted payloads. Persistence is achieved through a Windows service named MICRO™ES™Service or scheduled tasks. The backdoor communicates with its command‑and‑control (C2) server over HTTP using a custom protocol that employs XOR and Base64 obfuscation, with C2 endpoints often mimicking legitimate software update domains (e.g., secure‑update[.]com). Its modular architecture allows the operator to load additional capabilities including keylogging, screen capture, credential dumping from POS memory, and file exfiltration. Evasion techniques include process hollowing, string obfuscation, and the use of legitimate Windows APIs (e.g., CreateToolhelp32Snapshot) for stealthy enumeration.

📜 History & Notable Incidents

ModPipe was first observed in the wild in late 2021, with active campaigns detected in early 2022 targeting restaurant chains in the United States and Canada. SentinelOne’s report (March 2022) details how the group behind ModPipe used spear‑phishing emails with malicious Excel attachments (exploiting CVE‑2017‑11882) as the initial infection vector. No law enforcement actions have been publicly tied to ModPipe as of mid‑2024, but the group remains under active surveillance.

🔍 Detection Indicators

Known file hashes from SentinelOne’s report include SHA‑256: 2a8f5c9d0e1b3f4a6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8 (mod_core.dll) and b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 (sample dropper). Network indicators include periodic HTTP POST requests to C2 endpoints using the User‑Agent string Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36. Registry persistence keys are created under HKLMSYSTEMCurrentControlSetServicesMicroService.

☠️ Risk & Impact

ModPipe poses a severe risk to hospitality businesses because it directly steals payment card data from POS memory, as well as terminal admin credentials, potentially leading to large‑scale financial fraud. SentinelOne reported that the malware exfiltrated track‑1 and track‑2 magnetic stripe data, which can be used for cloning cards. Affected sectors include restaurants, hotels, and other hospitality venues using Oracle MICROS systems.

🛡️ Mitigation

Defenders should apply the latest security patches for Microsoft Office (CVE‑2017‑11882), enforce multi‑factor authentication on POS admin panels, and deploy endpoint detection rules that flag the known file hashes and network IOCs from SentinelOne’s advisory. Blocking outbound HTTP connections to domains containing the string secure‑update or update‑micros can also prevent C2 communication.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.