win.modpipe (Back to overview)


ModPipe is point-of-sale (POS) malware capable of accessing sensitive information stored in devices running ORACLE MICROS Restaurant Enterprise Series (RES) 3700 POS – a management software suite used by hundreds of thousands of bars, restaurants, hotels and other hospitality establishments worldwide. ModPipe uses modular architecture consisting of basic components and downloadable modules. One of them – named GetMicInfo – contains an algorithm designed to gather database passwords by decrypting them from Windows registry values. Exfiltrated credentials allow ModPipe's operators access to database contents, including various definitions and configuration, status tables and information about POS transactions.

2022-06-02KrollSean Straw
ModPipe POS Malware: New Hooking Targets Extract Card Data
2021-03-23ForegenixMark Shelhart, Niall Newman
ModPipe Malware has a new module that siphons Credit Card Data
2020-11-12ESET ResearchMartin Smolár
Hungry for data, ModPipe backdoor hits POS software used in hospitality sector

There is no Yara-Signature yet.