A new wave of targeted campaigns is detected against financial, manufacturing and retail businesses that began in early October. This campaign started with a TrickBot infection and progressed into a hacking operation targeting sensitive financial systems. This new operation is focused on targeting point of sale (PoS) systems. The campaign leverages a newly discovered malware family called Anchor exclusively for high-profile targets. The campaign shows resemblance to past attacks that were linked to the financially-motivated FIN6 threat actor, a group that is known to target POS systems and has been linked to TrickBot infections in the past. The attacks target POS systems to steal sensitive information by taking over critical assets in the victims’ network. Anchor_DNS is a backdoor that uses the DNS protocol to stealthily communicate with C2 servers. The majority of the initial interactive hacking operation uses the known tools Meterpreter, PowerShell Empire, and Cobalt Strike for reconnaissance and lateral movement.