{
  "family": "neutrinopos",
  "sample_count": 60,
  "category": "trojan",
  "description": "NeutrinoPoS (also widely tracked in cyber threat intelligence as Kasidet, Trojan:Win32/Kasidet, and MWZLesson) is a notorious Point-of-Sale (PoS) malware family and modular botnet active since late 2013. Evolving from the Neutrino Bot commodity framework, NeutrinoPoS incorporates specialized RAM-scraping modules derived from earlier PoS strains like Dexter to harvest unencrypted payment card Track 1 and Track 2 magnetic stripe data directly from process memory in retail POS terminals. The malware features sophisticated sandbox and virtual machine detection to evade automated analysis, bypasses User Account Control (UAC), and communicates with C2 servers utilizing decentralized Namecoin .bit domains to resist takedowns. Attackers leverage NeutrinoPoS for large-scale credit card data theft, credential logging, and coordinated distributed denial-of-service (DDoS) attacks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/NeutrinoPoS",
    "Trojan:Win32/Kasidet",
    "Kasidet",
    "MWZLesson",
    "NeutrinoBot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is NeutrinoPoS (Kasidet)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NeutrinoPoS (Kasidet) is a point-of-sale malware family and botnet that scrapes credit card data from system memory."
      }
    },
    {
      "@type": "Question",
      "name": "How does NeutrinoPoS steal payment card data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scrapes RAM of retail processes to extract unencrypted Track 1 and Track 2 magnetic stripe credit card details."
      }
    },
    {
      "@type": "Question",
      "name": "What defense evasion capabilities are built into NeutrinoPoS?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It detects virtual machines, sandboxes, and debuggers, terminating itself if analysis environments are detected."
      }
    },
    {
      "@type": "Question",
      "name": "How does NeutrinoPoS resist command-and-control takedowns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses decentralized Namecoin .bit top-level domains resolved via OpenNIC servers to prevent domain seizure."
      }
    },
    {
      "@type": "Question",
      "name": "How can retail organizations protect payment terminals from NeutrinoPoS?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy point-to-point encryption (P2PE), isolate POS networks, enforce strict application whitelisting, and use EDR."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1003",
    "T1055",
    "T1547.001",
    "T1498",
    "T1082",
    "T1071.001",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1021.001",
      "name": "Remote Services: Remote Desktop Protocol",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately sever all infected PoS terminals from the internet and the corporate network to halt the exfiltration of credit card data.",
    "Capture a forensic RAM image of the infected terminals to confirm the presence of the scraping regex and identify any stolen data still in memory.",
    "Initiate immediate incident response protocols per PCI-DSS requirements, including notifying acquiring banks and payment processors.",
    "Identify the lateral movement vector (e.g., exposed RDP, weak service accounts) used to deploy the malware to the PoS segment and close it."
  ],
  "what_to_avoid": [
    "Do not reboot the PoS terminal until a forensic RAM image is captured; rebooting destroys the evidence of the active RAM scraping.",
    "Avoid assuming the threat is isolated to a single terminal; PoS malware is almost always deployed network-wide by the attacker."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Fraud & Payment Card Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": "Neutrino Bot / Kasidet Syndicate",
  "delivery_mechanism": [
    "Malicious Spam Campaigns with Weaponized Macros",
    "RIG and Neutrino Exploit Kits",
    "Secondary Droppers (Dorkbot)"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows POSReady 7",
    "Windows Embedded POS"
  ],
  "capabilities": [
    "Point-of-Sale RAM Scraping (Track 1/2 Data)",
    "Virtual Machine & Sandbox Detection",
    "Decentralized Namecoin (.bit) C2 Resolution",
    "UAC Privilege Escalation",
    "DDoS Flooding Capabilities"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons exfiltrating scraped credit card track data to Namecoin .bit domains",
      "High-volume UDP/TCP flood traffic during DDoS activation"
    ],
    "evasion_techniques": [
      "Checking for sandbox/VM registry artifacts and terminating if detected",
      "Code injection into trusted Windows processes"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Kasidet",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\POSManager"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High",
    "scope": "Mass payment card data breach, retail merchant financial compromise, DDoS disruption"
  },
  "lineage": {
    "derived_from": [
      "Dexter PoS & Neutrino Bot Codebases"
    ],
    "variants": [
      "Kasidet 1.2",
      "Kasidet 2.0",
      "MWZLesson"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a",
      "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b"
    ],
    "delivery": [
      "invoice_pos.exe",
      "order_details.doc"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\KasidetClient",
      "%AppData%\\Kasidet\\kasidet.exe"
    ]
  },
  "sources": [
    {
      "name": "Zscaler ThreatLabz - Kasidet (Neutrino Bot) Analysis and PoS Scraping",
      "url": "https://www.zscaler.com/blogs/security-research"
    },
    {
      "name": "ESET Research - Neutrino Bot / Kasidet POS Threat Analysis",
      "url": "https://www.welivesecurity.com"
    }
  ]
}