{
  "family": "kasidet",
  "sample_count": 294,
  "category": "pos_malware",
  "description": "Backdoor:Win32/Kasidet (widely known as Neutrino Bot) is an infamous, multi-functional botnet agent notorious for executing massive DDoS attacks and scraping memory for Point-of-Sale (PoS) credit card data.<br><br><b>Understanding Kasidet</b><br>To the victim organization, Kasidet operates silently until it is utilized in a massive DDoS attack or a credit card breach is discovered. For threat intelligence analysts, Kasidet (Neutrino Bot) represents a highly versatile cybercrime commodity. Sold on underground forums for a few hundred dollars, it allows amateur cybercriminals to deploy a highly effective backdoor with built-in keylogging, form-grabbing, and specialized PoS memory scraping modules.<br><br><b>Execution and Evasion Strategies</b><br>Kasidet is distributed via malspam campaigns, exploit kits (ironically, often the Neutrino Exploit Kit), and malicious USB drives. Upon execution, it injects its heavily obfuscated payload into <code>explorer.exe</code> or <code>svchost.exe</code>. It establishes persistence via the Registry Run keys. Kasidet's C2 communications are heavily encrypted, frequently utilizing base64 encoding and custom RC4 encryption over HTTP POST requests. The bot checks for virtualization and actively attempts to disable Windows Defender and other installed AV engines.<br><br><b>Indicators of Compromise & Impact</b><br>The impact of Kasidet is severe, particularly for retail organizations, as its memory-scraping module actively hunts for Track 1 and Track 2 credit card data in RAM. Incident responders should look for anomalous outbound HTTP POST traffic to known malicious IP addresses. EDR tools will frequently flag Kasidet for 'Suspicious Process Injection' and 'Memory Scraping/Dumping' behavior. Memory forensics is absolutely critical to extract the unencrypted payload and identify the specific C2 panel controlling the bot.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1005",
    "T1055",
    "T1498",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactic": "Collection"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network; if it is a PoS terminal, active credit card theft is likely occurring.",
    "Capture a full forensic memory image of the machine to extract the decrypted Kasidet payload, C2 configuration, and any scraped track data.",
    "Force a global password reset for all user accounts and audit the firewall for any unauthorized outbound traffic.",
    "Perform a clean OS rebuild and ensure all Point-of-Sale terminals are heavily segmented from general corporate internet access."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence.",
    "Avoid rebooting a PoS terminal suspected of Kasidet infection before capturing memory, as the scraped credit card data exists only in RAM."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}