New Clues in the Target Breach
Summary: Analysis of the Target breach malware points to a Windows share named "ttcopscli3acs" on internal address 10.116.240.31, where stolen register data was uploaded using the account "Best1_user" and password "BackupU$r". That username matches an administrator-level account installed by BMC Software's Performance Assurance for Microsoft Servers, and a malware component installed itself as a service called "BladeLogic" to mimic BMC's BladeLogic Automation Suite.
What you should know: The attackers appear to have turned a vendor's built-in service account into a data-exfiltration path, and BMC's statement confirmed the password was not BMC-generated but did not rule out that a BMC-installed domain account was leveraged. Meanwhile, Rescator's shops released another two million cards dubbed "Eagle Claw", all used at Target between Nov. 27 and Dec. 15, and the FBI warned the underlying POS malware code dates back to at least 2011.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026