Mandiant FIN5 GrrCON Oct 2016

RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.

FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.

New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.

FIN5 uses SDelete to clean up the environment and attempt to prevent detection.

FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.

FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.

FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.

FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.

FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.

RawPOS installs itself as a service to maintain persistence.

RawPOS encodes credit card data it collected from the victim with XOR.

FLIPSIDE uses RDP to tunnel traffic from a victim environment.

FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.

FIN5 has cleared event logs from victims.