Maintaining the security of point-of-sale (POS) systems is a growing concern. A number of malware families targeting them were discovered this year, including Dexter, vSkimmer, BlackPOS and Alina. These are all examples of advanced malware designed to steal payment card information at the point of sale. One of the most interesting commonalities across these malware families is their use of a command-and-control (C&C) communication channel for data exfiltration.

Infections by Dexter

Dexter, for example, is a malware that targets POS systems, first discovered in December 2012 by Seculert. Dexter steals payment card data from the POS system and sends it to a C&C server hosted in the Republic of Seychelles. Most POS systems infected by Dexter run on Windows platforms: More than 50 percent of the infected systems run Windows XP, 17 percent run Windows Home Server, 9 percent run Windows Server 2003 and 7 percent run Windows 7.

Dexter’s method for infecting POS systems has yet to be determined. It is possible that POS systems are infected via drive-by downloads, but there is no evidence that this is the case. Some security experts believe that hackers establish a remote connection to the POS system (using misconfigured firewalls and default passwords on system processes) and then drop malware like Dexter directly on the machine.

Learn to Protect Corporate Credentials against Today’s Threats

more from Malware

Unprecedented Shift: The Trickbot Group is Systematically Attacking Ukraine

Following ongoing research our team, IBM Security X-Force has uncovered evidence indicating that the Russia-based cybercriminal syndicate "Trickbot group" has been systematically attacking Ukraine since the Russian invasion — an unprecedented shift as the group had not previously targeted Ukraine. Between mid-April and mid-June of 2022 the Trickbot group, tracked by X-Force as ITG23 and also known as Wizard Spider,…

World’s Largest Darknet Market Shut Down, $25 Million in Bitcoin Seized

On April 5, German authorities announced the takedown of the Hydra marketplace, the world’s largest darknet market trading in illicit drugs, cyberattack tools, forged documents and stolen data. The criminal operation, with about 17 million customer accounts, raked in billions in bitcoin before getting shut down. On its website, the Federal Criminal Police Office (BKA) stated it had secured and…

Countdown to Ransomware: Analysis of Ransomware Attack Timelines

This research was made possible through the data collection efforts of Maleesha Perera, Joffrin Alexander, and Alana Quinones Garcia. Key Highlights The average duration of an enterprise ransomware attack reduced 94.34% between 2019 and 2021:  2019: 2+ months — The TrickBot (initial access) to Ryuk (deployment) attack path resulted in a 90% increase in ransomware attacks investigated by X-Force Incident…