Forest Global Training Partners

Cyber Risks · Krebs on Security

A Closer Look at the Target Malware, Part II

Summary: McAfee confirmed that two malware uploaders tied to the Target attack contained the string "z:\Projects\Rescator\uploader\Debug\scheck.pdb," linking the code to the underground card-shop operator known as Rescator. Seculert reported the attack ran in two stages: point-of-sale malware at Target checkout counters stayed undetected for 6 days, then sent stolen data to an external FTP server on a hijacked website several times a day over two weeks, with 11 GBs pulled down via a Russian VPS.

What's compelling: The stolen data moved for two weeks before anyone outside the attackers knew, and files tied to the intrusion sat on Virustotal dated Dec. 11, 2013 - meaning someone had the malware in hand while the exfiltration was still running. Eleven gigabytes of customer card data left through a single FTP server, and antivirus tools still detected none of it on January 16.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related