A group of sophisticated attackers are repurposing penetration testing tools to
break into the networks of small and medium-size businesses worldwide with the goal
of infecting point-of-sale systems with malware.
The new attack campaign started in September and has been dubbed operation Black Atlas
by researchers from antivirus vendor Trend Micro. The attackers use a wide set of tools
to scan the Internet and identify potential weak spots in the networks of various organizations,
the researchers said.
Their toolset includes port scanners, brute-force password guessing tools, SMTP
(Simple Mail Transfer Protocol) scanners, remote desktop viewers and other attack
applications that are easy to find on the Internet.
"Networks with weak password practices are likely to fall victim to this initial penetration
testing stage," the Trend Micro researchers said in a blog post.
If the attackers manage to break in, they use additional malware and tools to move laterally
across the network and compromise PoS systems. While doing this, they steal various credentials
along the way, including email and Facebook passwords
Once they have access to a PoS system, the attackers install a so-called memory scraping program.
These are malware applications that scan the system's RAM for payment card details that are passed
from the card reader to the retail software.
The Trend Micro researchers have seen the Black Atlas attackers using multiple PoS malware programs
including Alina, NewPOSThings and BlackPOS. The latter was also used in the 2013 attack against Target
that resulted in the compromise of around 40 million payment card details.
Because BlackPOS does not have an online data exfiltration method and instead saves the card details
to a local text file, the Black Atlas attackers are combining it with a botnet-type backdoor program
known as Gorynych or Diamond Fox.
"Gorynych now grabs that text file and does an HTTP POST to complete the data exfiltration," the
Trend Micro researchers said. The same botnet is also used to deploy BlackPOS in the first place.
The attackers have compromised businesses around the world, including an unnamed healthcare organization
in the U.S., which allowed Trend Micro to perform a deeper analysis. The most affected countries are
the U.S., Australia, India, Taiwan, Germany and the U.K.
Lucian Constantin - Romania Correspondent