Attacks on point-of-sale (POS) systems have already had serious repercussions for major retailers, and the discovery of two different types of malware on ElasticSearch servers suggests similar incidents are on the way.

Experts at Kromtech Security outlined their findings in a post on MacKeeper, which asserted two different types of malware — JackPOS and AlinaPOS — had infected more than 4,000 ElasticSearch machines. Although less known outside the tech community, ElasticSearch is an open-source search engine based on a software license called Apache Lucene.

After initially discovering the malware during a routine scan, Kromtech researchers said more than a quarter of all ElasticSearch instances were exposed to files associated with hidden command-and-control servers. Perhaps even more worryingly, all but 1 percent of the ElasticSearch systems in question are being hosted on Amazon Web Services, one of the most popular cloud computing providers.

The Kromtech team told Bleeping Computer that they had reached out to Amazon but had yet to receive a response at press time. Meanwhile, the threat from the different types of malware could be serious. An analysis of the two strains showed they go back until last year, and in some cases, systems have been infected more than once.

Using AlinaPOS and JackPOS on ElasticSearch means threat actors could have been able to wipe out information, gain full admin rights and perform remote code execution, the International Business Times reported. The servers in question were highly vulnerable due to a lack of password security or technology to authenticate user sessions. As a result, the different types of malware might remain active on a whole group of systems even if they were detected on individual servers here and there.

As Threatpost pointed out, several other security experts have discovered and exposed the potential risks associated with ElasticSearch servers, AWS and even other open-source systems such as MongoDB. Some of these vulnerabilities have led to severe consequences with well-known organizations including Verizon, Time Warner and World Wrestling Entertainment.

Hopefully, more companies will take the Kromtech experts’ advice to double-check their log files and ensure all servers are properly configured, before the different types of malware lead to a new high-profile POS attack.