Skip to content
attack.paths
Connexion
← RegistryDossier · 7 steps · 6 edges

POS network pivot → RAM-scraper → card data exfil

The Target 2013 / Home Depot 2014 chain: vendor foothold → flat payment-switch VLAN → drop a memory-scraping malware on POS terminals → exfil track data through a payment-switch host.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target retail / hospitality network is flat between the payment-switch and the POS terminals. POS terminals are Windows-based with no application-allowlisting.

§ Steps

  1. 01
    Exfil to attacker drop serverExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Compromise vendor / contractor with network accessInitial Access
    T1078— Valid Accounts
  3. 03
    Connect via vendor VPN / portalInitial Access
    T1133— External Remote Services
  4. 04
    Stage on payment-switch hostCollection
    T1074— Data Staged
  5. 05
    Scrape track-2 data from RAMCollection
    POS-RAM-SCRAPE— POS RAM Scraping
  6. 06
    Deploy RAM-scraper malware on POSCollection
    POS-RAM-SCRAPE— POS RAM Scraping
  7. 07
    Pivot to payment-switch VLANLateral Movement
    POS-PAYMENT-SWITCH— Payment-Switch Network Pivot

§ References

§ Frequently asked

What is the "POS network pivot → RAM-scraper → card data exfil" attack path?
The Target 2013 / Home Depot 2014 chain: vendor foothold → flat payment-switch VLAN → drop a memory-scraping malware on POS terminals → exfil track data through a payment-switch host. It chains 7 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Exfil to attacker drop server (T1041) — a exfiltration primitive. Assumed environment: target retail / hospitality network is flat between the payment-switch and the POS terminals.
What is the final impact of this kill-chain?
The final step lands on Pivot to payment-switch VLAN (POS-PAYMENT-SWITCH), which falls under Lateral Movement. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers