Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

FindPOS: New POS Malware Family Discovered

Summary: Unit 42 discovered a new POS malware family it named FindPOS, with nine variants compiled as early as November 2014 that scrape process memory for track data, exfiltrate it via HTTP POST every 120 seconds, and added keylogging from version 5.90. The malware filters targets by reading each process owner through EnumProcesses, OpenProcess, GetTokenInformation and LookupAccountSid to keep only processes running as NT AUTHORITY, and researchers found 37 domains resolving to 13 unique IP addresses registered under falsified WHOIS details.

Key Takeaway: Nine variants and 37 hardcoded exfiltration domains put FindPOS in the same prevalence class as Alina and Backoff, and its process-owner filter means it only reads memory from services and system processes - the ones your endpoint tooling is least likely to watch.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related