{
  "family": "neutrinopos",
  "sample_count": 60,
  "category": "trojan",
  "description": "Trojan:Win32/Neutrinopos is a highly destructive, specialized Point-of-Sale (PoS) trojan engineered exclusively to infiltrate retail environments, scrape the RAM of PoS terminals for unencrypted credit card Track 1 and Track 2 data, and exfiltrate it to cybercriminals.<br><br><b>Understanding NeutrinoPOS</b><br>To the retail cashier, the PoS terminal appears to function normally. For incident responders, NeutrinoPOS represents a catastrophic breach of PCI-DSS compliance and a massive financial liability. Unlike traditional trojans that target files or keystrokes, NeutrinoPOS specifically targets the fleeting moment when a credit card is swiped and processed in the terminal's Random Access Memory (RAM), bypassing end-to-end encryption if the terminal architecture is flawed.<br><br><b>Execution and Evasion Strategies</b><br>NeutrinoPOS is typically deployed laterally by attackers who have already breached the corporate network (often via compromised Remote Desktop Protocol (RDP) credentials). The attacker pushes the NeutrinoPOS executable to the specific PoS terminals. Upon execution, it establishes persistence (often via a Windows Service). Its core function is a continuous loop of RAM scraping (`T1005`). It iterates through the memory space of running processes (like `pos.exe` or `aloha.exe`), using regular expressions to identify the specific structure of credit card Track 1 and Track 2 data. Once identified, the data is encrypted, saved to a hidden log file, and exfiltrated to the C2 server, often via DNS tunneling or HTTP POST requests.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a massive theft of customer payment data, resulting in severe reputational and financial damage. Incident responders will observe EDR alerts for continuous, aggressive memory reading (scans) across multiple processes. Network logs may reveal anomalous outbound HTTP traffic from PoS terminals that should strictly be communicating only with payment gateways. The presence of unexpectedly large, encrypted log files in the `%Temp%` or application directory of the PoS software is a strong IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1021.001",
    "T1048",
    "T1059.003",
    "T1005",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1021.001",
      "name": "Remote Services: Remote Desktop Protocol",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately sever all infected PoS terminals from the internet and the corporate network to halt the exfiltration of credit card data.",
    "Capture a forensic RAM image of the infected terminals to confirm the presence of the scraping regex and identify any stolen data still in memory.",
    "Initiate immediate incident response protocols per PCI-DSS requirements, including notifying acquiring banks and payment processors.",
    "Identify the lateral movement vector (e.g., exposed RDP, weak service accounts) used to deploy the malware to the PoS segment and close it."
  ],
  "what_to_avoid": [
    "Do not reboot the PoS terminal until a forensic RAM image is captured; rebooting destroys the evidence of the active RAM scraping.",
    "Avoid assuming the threat is isolated to a single terminal; PoS malware is almost always deployed network-wide by the attacker."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}