CherryPicker POS

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.cherry_picker

Threat Analysis

CherryPicker POS is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cocomelonc.github.io/tutorial/2022/05/16/malware-pers-5.html

→https://www.trustwave.com/Resources/SpiderLabs-Blog/New-Memory-Scraping-Technique-in-Cherry-Picker-PoS-Malware/

→https://www.trustwave.com/Resources/SpiderLabs-Blog/Shining-the-Spotlight-on-Cherry-Picker-PoS-Malware/

Quick Facts

TypeAPT / Threat Group

Aliases5

Also Known As

win.cherry_pickercherry_pickercherrypickercherrypickerposCherryPicker POS

External Intelligence

Malpedia: win.cherry_picker

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search CherryPicker POS