C2 With It All: From Ransomware To Carding
Summary: Cisco Talos found a single command-and-control server hosting a range of malware, including DoppelPaymer ransomware, the TinyPOS point-of-sale credit card capture malware, and loaders that execute code delivered directly from the C2. TinyPOS, written in assembly, exfiltrates hostname and local IP to the hardcoded domain jduuyerm[.]website and parses process memory to pull credit card track 1 and track 2 data, while a ransomware package with a hard-coded desktop path was uploaded on Sept. 24 and TinyPOS on Sept. 26.
What's compelling: One shared server carried both ransomware and carding tools, so the same infrastructure that encrypts a victim's servers can also be harvesting payment card tracks from point-of-sale memory - meaning an incident scoped as ransomware may also be a card breach.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026