Protecting POS Systems From Dexter and Other Advanced Malware

Maintaining the security of point-of-sale (POS) systems is a growing concern. A number of malware families targeting them were discovered this year, including Dexter, vSkimmer, BlackPOS and Alina. These are all examples of advanced malware designed to steal payment card information at the point of sale. One of the most interesting commonalities across these malware families is their use of a command-and-control (C&C) communication channel for data exfiltration.

Infections by Dexter

Dexter, for example, is a malware that targets POS systems, first discovered in December 2012 by Seculert. Dexter steals payment card data from the POS system and sends it to a C&C server hosted in the Republic of Seychelles. Most POS systems infected by Dexter run on Windows platforms: More than 50 percent of the infected systems run Windows XP, 17 percent run Windows Home Server, 9 percent run Windows Server 2003 and 7 percent run Windows 7.

Dexter’s method for infecting POS systems has yet to be determined. It is possible that POS systems are infected via drive-by downloads, but there is no evidence that this is the case. Some security experts believe that hackers establish a remote connection to the POS system (using misconfigured firewalls and default passwords on system processes) and then drop malware like Dexter directly on the machine.

Learn to Protect Corporate Credentials against Today’s Threats

Dana Tamir

Director of Enterprise Security at Trusteer, an IBM Company

Strela Stealer: Today’s invoice is tomorrow’s phish

12 min read - As of November 2024, IBM X-Force has tracked ongoing Hive0145 campaigns delivering Strela Stealer malware to victims throughout Europe - primarily Spain, Germany and Ukraine. The phishing emails used in these campaigns are real invoice notifications, which have been stolen through previously exfiltrated email credentials. Strela Stealer is designed to extract user credentials stored in Microsoft Outlook and Mozilla Thunderbird. During the past 18 months, the group tested various techniques to enhance its operation's effectiveness. Hive0145 is likely to be…

Hive0147 serving juicy Picanha with a side of Mekotio

17 min read - IBM X-Force tracks multiple threat actors operating within the flourishing Latin American (LATAM) threat landscape. X-Force has observed Hive0147 to be one of the most active threat groups operating in the region, targeting employee inboxes at scale, with a primary focus on phishing and malware distribution. After a 3-month break, Hive0147 returned in July with even larger campaign volumes, and the debut of a new malicious downloader X-Force named "Picanha,” likely under continued development, deploying the Mekotio banking trojan. Hive0147…

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated documents associated with finance, critical infrastructure, executive engagements, cyber security, maritime security, healthcare, business, and defense industrial production. Beginning in November 2023, X-Force observed ITG05…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Infections by Dexter

More from Malware

Strela Stealer: Today’s invoice is tomorrow’s phish

Hive0147 serving juicy Picanha with a side of Mekotio

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

Topic updates