FrameworkPOS

The FrameworkPOS is a piece of malware that targets Point-of-Sale (PoS) devices in the United States and Europe. According to news reports, the cybercrime group behind the FrameworkPOS (also known as Trinity Malware) is likely to originate from Russia and has been dubbed FIN6. The FIN6 cybercriminal group has been active in the cybercrime field since 2016, and it would appear that attacks on Point-of-Sale devices are their specialty. However, a recent campaign linked to them appears to utilize extra pieces of malware in case the system they infect is not tied to a point-of-sale device. It seems that the FIN6 hacking group may drop copies of the LockerGoga Ransomware or Ryuk Ransomware if they determine that the infected system is not suitable for the FrameworkPOS malware.

If they opt to use the FrameworkPOS malware, then the victim might not notice anything out of the ordinary, because the malware’s modules are loaded into the device’s memory, and it may log and send out credit card information to the attackers regularly. After this, they can sell the collected credit card details on underground markets – malware researchers suspect that the FIN6 group may have collected nearly 10 million cards in just two years, and this is likely to have netted them millions of profits.

The infection vectors used by the FIN6 group may vary, but it seems that the final result is always going to be threatening now that they have adopted the use of file-encryption Trojans. Protecting your system from threats like these requires you to apply all software updates as soon as possible and use an up-to-date anti-malware application.