Menu
New attack campaign against SMBs uses a botnet to deliver PoS malware

New attack campaign against SMBs uses a botnet to deliver PoS malware

A group of attackers uses the Gorynych botnet to deploy point-of-sale malware and steal payment card data

A group of sophisticated attackers are repurposing penetration testing tools to break into the networks of small and medium-size businesses worldwide with the goal of infecting point-of-sale systems with malware.

The new attack campaign started in September and has been dubbed operation Black Atlas by researchers from antivirus vendor Trend Micro. The attackers use a wide set of tools to scan the Internet and identify potential weak spots in the networks of various organizations, the researchers said.

Their toolset includes port scanners, brute-force password guessing tools, SMTP (Simple Mail Transfer Protocol) scanners, remote desktop viewers and other attack applications that are easy to find on the Internet.

"Networks with weak password practices are likely to fall victim to this initial penetration testing stage," the Trend Micro researchers said in a blog post.

If the attackers manage to break in, they use additional malware and tools to move laterally across the network and compromise PoS systems. While doing this, they steal various credentials along the way, including email and Facebook passwords.

Once they have access to a PoS system, the attackers install a so-called memory scraping program. These are malware applications that scan the system's RAM for payment card details that are passed from the card reader to the retail software.

The Trend Micro researchers have seen the Black Atlas attackers using multiple PoS malware programs including Alina, NewPOSThings and BlackPOS. The latter was also used in the 2013 attack against Target that resulted in the compromise of around 40 million payment card details.

Because BlackPOS does not have an online data exfiltration method and instead saves the card details to a local text file, the Black Atlas attackers are combining it with a botnet-type backdoor program known as Gorynych or Diamond Fox.

"Gorynych now grabs that text file and does an HTTP POST to complete the data exfiltration," the Trend Micro researchers said. The same botnet is also used to deploy BlackPOS in the first place.

The attackers have compromised businesses around the world, including an unnamed healthcare organization in the U.S., which allowed Trend Micro to perform a deeper analysis. The most affected countries are the U.S., Australia, India, Taiwan, Germany and the U.K.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Examining the changing job scene in the Kiwi channel

Examining the changing job scene in the Kiwi channel

Typically, the New Year brings new opportunities for personnel within the Kiwi channel. 2017 started no differently, with a host of appointments, departures and reshuffles across vendor, distributor and reseller businesses. As a result, the job scene across New Zealand has changed - here’s a run down of who is working where in the year ahead…

Examining the changing job scene in the Kiwi channel
​What are the top 10 tech trends for New Zealand in 2017?

​What are the top 10 tech trends for New Zealand in 2017?

Digital Transformation (DX) has been a critical topic for business over the last few years and IDC is now predicting a step change as DX reaches macroeconomic levels. By 2020 a DX economy will emerge and it will become the core of what New Zealand industries focus on. From the board level through to the C-Suite, Kiwi organisations must be prepared to think and act digital when the DX economy emerges in 2017.

​What are the top 10 tech trends for New Zealand in 2017?
Show Comments