Cybercriminals borrow from APT playbook in attack against PoS vendors

Attackers impersonated point-of-sale system owners in need of technical assistance in a spear-phishing attack targeting PoS vendors

Cybercriminals are increasingly copying cyberespionage groups in using targeted attacks against their victims instead of large-scale, indiscriminate infection campaigns.

This change in tactics has been observed among those who launch attacks, as well as those who create and sell attack tools on the underground market.

A recent example of such behavior was seen in a cybercriminal attack against vendors of point-of-sale systems that researchers from RSA documented last week.

The attackers sent emails to specific vendors impersonating small businesses such as restaurants. This technique, known as spear-phishing, is typically associated with advanced persistent threats (APTs) -- highly targeted, customized attacks whose goal is usually long-term cyberespionage.

"I am emailing you because nobody from your company is returning my calls," one of the malicious emails sent to a European PoS vendor reads. "I am having a problem with two of my terminals, getting random blue screens of death. Please give me a call. I have attached my business card!"

The attachment was a malicious Word document that attempted to exploit two Microsoft Office vulnerabilities -- CVE-2014-1761 and CVE-2012-0158, the RSA researchers said in a blog post. The exploits were obfuscated to evade antivirus detection with a technique that hadn't been seen before, they said.

According to researchers from FireEye, who also analyzed the attack, the exploit's payload was a well-known computer Trojan known as Vawtrak that can steal passwords and digital certificates; log key strokes; take screen shots; and enable remote desktop access to infected systems.

Compromising the computers and networks of PoS vendors can prove highly valuable for attackers, because they can use such access to steal schematics, product configurations, customer lists and, more importantly, maintenance or remote support credentials.

This information could help them compromise PoS terminals for which the vendor also offers technical support. In fact, both the RSA and FireEye researchers found strong links between this attack's infrastructure and recent infections of Poseidon, a malware program designed to steal payment card data from the memory of PoS terminals.

Another interesting aspect of the spear-phishing campaign targeting PoS vendors was the attackers' use of a new document-based exploit kit called Microsoft Word Intruder (MWI), the FireEye researchers said Monday in a blog post.

Exploit kits are attack tools that bundle multiple exploits. They are sold on the underground market, usually on a subscription-based model, and most of them are used to launch mass attacks through compromised websites or malicious ads. But not MWI it seems.

"The distributor of MWI, who is also the author, markets the exploit kit as an APT tool -- capable of directing an attack on a specific individual or firm -- and has warned customers he will revoke the license of anyone caught using the tool for spam."

This is a shift from the traditional cybercriminal attacks where the goal is to compromise as many victims as possible, regardless of who they are or what they do.

It's clear that cybercriminals today engage in both indiscriminate campaigns and targeted attacks, the FireEye researchers said. "The combination of these targeted intrusions with a widely deployed payload can make it difficult for network security monitors to assess the level of risk associated with the threat."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags intrusionsecuritydata breachFireEyeExploits / vulnerabilitiesmalwarersa

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?