{
  "family": "lockpos",
  "sample_count": 1,
  "category": "trojan",
  "description": "Trojan:Win32/Lockpos is a highly specialized InfoStealer designed with a singular focus: the theft of credit card and payment data from Point-of-Sale (PoS) systems, hospitality networks, and e-commerce endpoints. The name relates to its target (PoS systems) and its objective to lock onto valuable financial data (`T1005`).<br><br><b>Understanding Lockpos (PoS/Credit Card Stealers)</b><br>To an end-user or cashier, the infection is entirely invisible; the PoS terminal functions normally. For a business, Lockpos represents a catastrophic data breach leading to massive PCI-DSS compliance fines, reputational destruction, and financial liability as customer cards are cloned and abused.<br><br><b>Execution and Extraction Mechanics</b><br>Lockpos is typically deployed after an attacker has breached a corporate network (often via exposed RDP or weak vendor credentials) and pivoted to the isolated PoS VLAN. Upon execution, it establishes stealthy persistence (e.g., as a hidden Windows Service). Its primary mechanism is 'RAM Scraping' (`T1005`). It continuously scans the volatile memory (RAM) of running processes (like the POS application itself, e.g., `pos.exe`) looking for Track 1 and Track 2 magnetic stripe data. Before exfiltrating the data, it frequently validates the scraped numbers, discarding junk data to keep its exfiltration footprint minimal (`T1041`). It often injects itself into `explorer.exe` to hide its network traffic.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the mass compromise of customer financial data. Host-based IoCs include EDR alerts for anomalous processes constantly calling `ReadProcessMemory` against legitimate PoS applications, and the creation of hidden, encrypted staging files in `%Temp%` containing the validated card data. Network IoCs include a 'beacon' or exfiltration burst over HTTP/HTTPS, DNS tunneling, or ICMP to a C2 server, occurring at regular intervals or at the end of the business day.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1005",
    "T1041",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1005",
      "name": "Data from Local System: RAM Scraping (Continuously scanning memory for credit card data)",
      "tactic": "Collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Sending the validated Track 1/2 data to the attacker)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Injecting into explorer.exe to mask exfiltration traffic)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the affected PoS terminals from the internet and the broader corporate network.",
    "Do not reboot the PoS terminals until a full memory dump (RAM) has been captured, as the malware operates heavily in memory and may store unexfiltrated cards there.",
    "Engage a specialized Payment Card Industry (PCI) forensic investigator (PFI) to determine the scope of the cardholder data breach.",
    "Review network segmentation to determine how the attacker pivoted from the corporate network into the isolated PoS environment."
  ],
  "what_to_avoid": [
    "Do not attempt to 'clean' a compromised PoS terminal; it must be completely wiped and reimaged from a known-good, secure baseline.",
    "Avoid relying solely on traditional AV on PoS systems; application whitelisting (AppLocker) is required to prevent unauthorized memory scrapers from running."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}