Pos Malware Threats

Threat Class: Cyber Threat / Pos Malware Tracked Families: 2 Severity: HIGH MITRE ATT&CK Aligned

Threat Landscape & Operational Overview

Pos Malware encompasses a distinct class of malicious software engineered to compromise computing environments, subvert security perimeters, and execute unauthorized actions on victim systems. Threats in this category leverage modern evasion tradecraft, persistent execution mechanisms, and multi-stage infection vectors to target enterprise infrastructure and individual users alike. Systematic threat intelligence, endpoint detection, and incident containment are essential to mitigate organizational exposure.

🛡️ Enterprise Incident Response & Hardening Guidance

Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:

→ Open Master Guide: Think You've Been Hacked? What To Do First

Primary MITRE ATT&CK Tactics & Techniques

Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:

ID Technique Tactic Observed Operational Behavior
T1059 Command and Scripting Interpreter Execution Executes automated commands and shell scripts on target endpoints.
T1055 Process Injection Defense Evasion Injects malicious logic into legitimate processes to bypass endpoint security.
T1547 Boot or Logon Autostart Execution Persistence Establishes automated persistence mechanisms across system restarts.
T1071 Application Layer Protocol Command & Control Communicates with remote operator infrastructure using standard web protocols.

Actively Weaponized Exploits & Vulnerabilities (2 CVEs)

Adversaries deploying pos malware threats frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:

CVE-2012-0158 CVSS 9.3 CRITICAL

Microsoft Office MSCOMCTL.OCX ActiveX TreeView / ListView Buffer Overflow

Attributed Payloads: kasidet

View Exploitation Dossier →
CVE-2017-11882 CVSS 7.8 HIGH

Microsoft Office Equation Editor Stack Buffer Overflow (EQNEDT32.EXE)

Attributed Payloads: kasidet

View Exploitation Dossier →
→ Explore all 63 weaponized vulnerabilities in our master CVE Exploitation Matrix

SOC Incident Containment Checklist

Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:

  1. Isolate affected endpoints from the network immediately to sever unauthorized communications.
  2. Identify active malicious processes and capture volatile system memory for forensic analysis.
  3. Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services.
  4. Deploy updated endpoint detection signatures and verify perimeter firewall rules.
  5. Re-image compromised systems using verified clean golden images.
⚠️ Critical Mistakes to Avoid:
  • Do not attempt manual file deletion while network connections remain active.
  • Do not restore from untested backups without verifying that the backup snapshot predates the intrusion.

Prominent Malware Families in this Category

Top documented threats ranked by historical prevalence and behavioral signatures:

kasidet

EMBER Samples: 294

Kasidet (cataloged across threat research as Neutrino Bot, Win32/Kasidet, Trojan.Kasidet, and Backdoor:Win32/Kasidet) is a sophisticated ...

View Profile & Rules →

hydrapos

EMBER Samples: 14

HydraPOS (classified in threat intelligence feeds as Trojan:Win32/HydraPOS and Trojan-POS.Win32.Hydra) is a specialized Point-of-Sale (PO...

View Profile & Rules →

Complete Directory (2 Families)

Alphabetical index of all tracked malware families cataloged under pos malware threats: