Trusted Design

POSEIDON AND BACKOFF POS

概要

Poseidon, also known as FindPOS, is a malware family designed for Windows point-of-sale systems. Poseidon scans the memory for running processes and employs keystroke logging to gather payment card data and credentials. Recent Team Cymru analysis of Poseidon samples revealed a number of similarities to the much-publicized Backoff POS malware family, and this post documents those similarities and a number of new IOCs.

Created: 2026-02-23

Indicators

類似Pulses

PoSeidon, A Deep Dive Into Point of Sale Malware (score: 0.75)
New PoSeidon spotted (score: 0.62)
KASPERSKY 2016-02-09: Poseidon Group: a Targeted Attack Boutique (score: 0.61)
MajikPOS Combines PoS Malware and RATs to Pull Off its Malicious Tricks (score: 0.59)
NitlovePOS: Another New POS Malware (score: 0.59)

このPulseに関連する脅威アクター (事実ベース)

APT28

Score: 10.91

Matched TTPs:

T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1057 - Process Discovery
T1102.002 - Bidirectional Communication
T1221 - Template Injection

MITREへのリンク →

CURIUM

Score: 3.84

Matched TTPs:

T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

MITREへのリンク →

Storm-1811

Score: 3.84

Matched TTPs:

T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

MITREへのリンク →

Volt Typhoon

Score: 3.28

Matched TTPs:

T1057 - Process Discovery
T1046 - Network Service Discovery

MITREへのリンク →

Tropic Trooper

Score: 15.47

Matched TTPs:

T1057 - Process Discovery
T1573 - Encrypted Channel
T1573.002 - Asymmetric Cryptography
T1221 - Template Injection
T1046 - Network Service Discovery
T1078.003 - Local Accounts

MITREへのリンク →

Deep Panda

Score: 4.26

Matched TTPs:

T1057 - Process Discovery
T1218.010 - Regsvr32

MITREへのリンク →

HAFNIUM

Score: 4.18

Matched TTPs:

T1057 - Process Discovery
T1078.003 - Local Accounts

MITREへのリンク →

Play

Score: 4.18

Matched TTPs:

T1057 - Process Discovery
T1078.003 - Local Accounts

MITREへのリンク →

Stealth Falcon

Score: 5.14

Matched TTPs:

T1057 - Process Discovery
T1555.004 - Windows Credential Manager

MITREへのリンク →

TeamTNT

Score: 3.28

Matched TTPs:

T1057 - Process Discovery
T1046 - Network Service Discovery

MITREへのリンク →

Chimera

Score: 6.90

Matched TTPs:

T1057 - Process Discovery
T1111 - Multi-Factor Authentication Interception
T1046 - Network Service Discovery

MITREへのリンク →

Lazarus Group

Score: 16.18

Matched TTPs:

T1057 - Process Discovery
T1102.002 - Bidirectional Communication
T1046 - Network Service Discovery
T1027.007 - Dynamic API Resolution
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1529 - System Shutdown/Reboot

MITREへのリンク →

Storm-0501

Score: 4.26

Matched TTPs:

T1057 - Process Discovery
T1218.010 - Regsvr32

MITREへのリンク →

Medusa Group

Score: 9.65

Matched TTPs:

T1057 - Process Discovery
T1573.002 - Asymmetric Cryptography
T1046 - Network Service Discovery
T1529 - System Shutdown/Reboot

MITREへのリンク →

Mustang Panda

Score: 14.70

Matched TTPs:

T1057 - Process Discovery
T1678 - Delay Execution
T1046 - Network Service Discovery
T1027.007 - Dynamic API Resolution
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

FIN7

Score: 6.58

Matched TTPs:

T1057 - Process Discovery
T1102.002 - Bidirectional Communication
T1078.003 - Local Accounts

MITREへのリンク →

Turla

Score: 10.20

Matched TTPs:

T1057 - Process Discovery
T1102.002 - Bidirectional Communication
T1555.004 - Windows Credential Manager
T1078.003 - Local Accounts

MITREへのリンク →

MuddyWater

Score: 3.92

Matched TTPs:

T1057 - Process Discovery
T1102.002 - Bidirectional Communication

MITREへのリンク →

Rocke

Score: 3.28

Matched TTPs:

T1057 - Process Discovery
T1046 - Network Service Discovery

MITREへのリンク →

Magic Hound

Score: 9.30

Matched TTPs:

T1057 - Process Discovery
T1573 - Encrypted Channel
T1102.002 - Bidirectional Communication
T1046 - Network Service Discovery

MITREへのリンク →

APT37

Score: 7.54

Matched TTPs:

T1057 - Process Discovery
T1102.002 - Bidirectional Communication
T1529 - System Shutdown/Reboot

MITREへのリンク →

Kimsuky

Score: 12.95

Matched TTPs:

T1057 - Process Discovery
T1218.010 - Regsvr32
T1102.002 - Bidirectional Communication
T1111 - Multi-Factor Authentication Interception
T1078.003 - Local Accounts

MITREへのリンク →

HEXANE

Score: 3.92

Matched TTPs:

T1057 - Process Discovery
T1102.002 - Bidirectional Communication

MITREへのリンク →

Inception

Score: 7.42

Matched TTPs:

T1057 - Process Discovery
T1218.010 - Regsvr32
T1221 - Template Injection

MITREへのリンク →

OilRig

Score: 12.40

Matched TTPs:

T1057 - Process Discovery
T1573.002 - Asymmetric Cryptography
T1555.004 - Windows Credential Manager
T1046 - Network Service Discovery
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Gamaredon Group

Score: 7.07

Matched TTPs:

T1057 - Process Discovery
T1102.002 - Bidirectional Communication
T1221 - Template Injection

MITREへのリンク →

APT38

Score: 5.14

Matched TTPs:

T1057 - Process Discovery
T1529 - System Shutdown/Reboot

MITREへのリンク →

BITTER

Score: 3.62

Matched TTPs:

T1573 - Encrypted Channel

MITREへのリンク →

APT29

Score: 10.83

Matched TTPs:

T1573 - Encrypted Channel
T1562.008 - Disable or Modify Cloud Logs
T1078.003 - Local Accounts

MITREへのリンク →

Cobalt Group

Score: 7.26

Matched TTPs:

T1218.010 - Regsvr32
T1573.002 - Asymmetric Cryptography
T1046 - Network Service Discovery

MITREへのリンク →

Blue Mockingbird

Score: 7.28

Matched TTPs:

T1218.010 - Regsvr32
T1574.012 - COR_PROFILER

MITREへのリンク →

APT32

Score: 9.92

Matched TTPs:

T1218.010 - Regsvr32
T1046 - Network Service Discovery
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1078.003 - Local Accounts

MITREへのリンク →

APT39

Score: 4.16

Matched TTPs:

T1102.002 - Bidirectional Communication
T1046 - Network Service Discovery

MITREへのリンク →

Velvet Ant

Score: 5.41

Matched TTPs:

T1573.002 - Asymmetric Cryptography
T1078.003 - Local Accounts

MITREへのリンク →

RedCurl

Score: 4.51

Matched TTPs:

T1573.002 - Asymmetric Cryptography
T1046 - Network Service Discovery

MITREへのリンク →

APT42

Score: 6.37

Matched TTPs:

T1573.002 - Asymmetric Cryptography
T1111 - Multi-Factor Authentication Interception

MITREへのリンク →

FIN6

Score: 7.26

Matched TTPs:

T1573.002 - Asymmetric Cryptography
T1046 - Network Service Discovery
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

FIN8

Score: 5.49

Matched TTPs:

T1573.002 - Asymmetric Cryptography
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Wizard Spider

Score: 6.37

Matched TTPs:

T1555.004 - Windows Credential Manager
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Dragonfly

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

Confucius

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

DarkHydrus

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

LAPSUS$

Score: 3.62

Matched TTPs:

T1111 - Multi-Factor Authentication Interception

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Lazarus Group

Score: 0.79

Matched TTPs:

T1102.002 - Bidirectional Communication
T1027.007 - Dynamic API Resolution
T1057 - Process Discovery
T1529 - System Shutdown/Reboot
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1046 - Network Service Discovery

MITREへのリンク →

Tropic Trooper

Score: 0.75

Matched TTPs:

T1573 - Encrypted Channel
T1057 - Process Discovery
T1078.003 - Local Accounts
T1221 - Template Injection
T1046 - Network Service Discovery
T1573.002 - Asymmetric Cryptography

MITREへのリンク →

Mustang Panda

Score: 0.70

Matched TTPs:

T1678 - Delay Execution
T1027.007 - Dynamic API Resolution
T1057 - Process Discovery
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1046 - Network Service Discovery

MITREへのリンク →

Kimsuky

Score: 0.64

Matched TTPs:

T1102.002 - Bidirectional Communication
T1057 - Process Discovery
T1078.003 - Local Accounts
T1111 - Multi-Factor Authentication Interception
T1218.010 - Regsvr32

MITREへのリンク →

OilRig

Score: 0.60

Matched TTPs:

T1057 - Process Discovery
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1046 - Network Service Discovery
T1573.002 - Asymmetric Cryptography
T1555.004 - Windows Credential Manager

MITREへのリンク →

APT28

Score: 0.56

Matched TTPs:

T1102.002 - Bidirectional Communication
T1057 - Process Discovery
T1221 - Template Injection
T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

MITREへのリンク →

Medusa Group

Score: 0.55

Matched TTPs:

T1573.002 - Asymmetric Cryptography
T1057 - Process Discovery
T1529 - System Shutdown/Reboot
T1046 - Network Service Discovery

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る