VERY IMPORTANT

Widely deploying FrameworkPOS on compromised POS systems. Collecting compromised data in numbered “.dll” files. Extensive use of Metasploit and PowerShell to move laterally and deploy malware. Frequent use of Windows Scheduled Tasks to maintain persistence. Heavy SQL database reconnaissance and data theft. Using Secure Shell (SSH) tunnels for SQL database exfiltration. Compromising the Active Directory Database (ntds.dit), allowing for credential harvesting and password cracking offline.