has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.  has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.