H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[RawPOS](https://attack.mitre.org/software/S0169) is a point-of-sale (POS) malware family that searches for cardholder data on victims. It has been in use since at least 2008. (Citation: Kroll RawPOS Jan 2017) (Citation: TrendMicro RawPOS April 2015) (Citation: Visa RawPOS March 2015) FireEye divides RawPOS into three components: FIENDCRY, DUEBREW, and DRIFTWOOD. (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)

Labels

malware

6 recorded

Relationships

uses

from FIN5

Group

uses

to Archive via Custom Method

Technique

uses

to Data from Local System

Technique

uses

to Local Data Staging

Technique

uses

to Masquerade Task or Service

Technique

uses

to Windows Service

Technique

11 external

References

mitre-attack

S0169

RawPOS

—

FIENDCRY

—

DUEBREW

—

DRIFTWOOD

—

Kroll RawPOS Jan 2017

https://www.kroll.com/en/insights/publications/malware-analysis-report-rawpos-malware

TrendMicro RawPOS April 2015

http://sjc1-te-ftp.trendmicro.com/images/tex/pdf/RawPOS%20Technical%20Brief.pdf

Visa RawPOS March 2015

https://usa.visa.com/dam/VCOM/download/merchants/alert-rawpos.pdf

Mandiant FIN5 GrrCON Oct 2016

https://www.youtube.com/watch?v=fevGZs0EQu8

DarkReading FireEye FIN5 Oct 2015

https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?

Github Mempdump

https://github.com/DiabloHorn/mempdump