Menu
New point-of-sale malware distributed by Andromeda botnet

New point-of-sale malware distributed by Andromeda botnet

Attackers use spam to infect systems with the Andromeda backdoor and then deploy GamaPoS on select point-of-sale machines

Attackers infect point-of-sale terminals with malware

Attackers infect point-of-sale terminals with malware

Cybercriminals are casting increasingly wider nets in their search for new point-of-sale systems to infect. This appears to be the case with a new memory scraping malware program called GamaPoS that's distributed by a large botnet known as Andromeda.

GamaPoS was recently discovered by security researchers from antivirus vendor Trend Micro, who found systems infected with it inside organizations from 13 U.S. states and Vancouver, Canada.

The program is written in Microsoft's .NET, which is unusual for RAM scraping malware. These type of threats monitor the memory of point-of-sale systems for payment card data and steal it while it's being passed from the physical card readers to the commerce applications.

Attackers have historically infected PoS systems by stealing or guessing remote access credentials. However, the numerous PoS breaches at large retailers in recent years have prompted many organizations to secure their remote access procedures, making this attack vector less attractive for cybercriminals.

This would explain why the GamaPoS gang has taken a different approach. Instead of directly targeting PoS systems from the Internet they're going after them from inside the trusted internal networks of companies.

Their attacks start with spam, according to the Trend Micro researchers. They send rogue emails purporting to include PCI DSS (Payment Card Industry Data Security Standard) compliance documents or updates for back office customer service systems from the Oracle Micros PoS suite.

The documents contain malicious macros -- automation scripts -- that install a backdoor program if allowed to execute. The infected systems then become part of the Andromeda botnet, which has been around since 2011 and has seen an increasing presence in the U.S. this year.

The attackers use the Andromeda backdoor to install GamaPoS on systems that are potential PoS targets.

"Rough estimates show us that GamaPOS may have only hit 3.8 percent of those affected by Andromeda," the Trend Micro researchers said in a blog post.

The attackers also use the backdoor to download specialized tools than can then be used to manually hack other systems from the networks of affected organizations.

GamaPoS infections have been found in a wide variety of industries, including companies that are in the business of pet care, theater, furniture wholesale, home health care, online retail and consumer electronics.

"Businesses that use Visa, Discovery, and Maestro (among other credit and debit cards) risk losing their customers' data to GamaPoS," the Trend Micro researchers warned.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags fraudmalwaretrend micro

Brand Post

What to expect from your IT Distributor

Whether you’re just starting out or you’ve been around since before the dot com rollercoaster, choosing the right distribution partner can be a pivotal factor in your success. This definitive guide outlines the traits that every IT partner needs to look for in their IT Distributor.

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments