RSA’s security experts discovered that through this operation, attackers utilized the ChewBacca Trojan to grab Track 1 and Track 2 info from payment cards swiped through infected PoS systems going back to Oct. 25, 2013.
ChewBacca isn’t new, and it’s also not solely employed to target POS systems. The malware comes with the cabability to log keystrokes and scrape a system’s memory. In accordance with the RSA, the memory scanner feature dumps a reproduction of the system’s process memory and searches it for payment card data. If a card number is found, it is extracted and recorded by the server, the RSA stated.
This specific piece of malware also applies the TOR network to hide it’s command-and-control servers pointed out in December by Kaspersky Labs.
“RSA observed that communication is handled through the TOR network, concealing the real IP address of the Command and Control (C&C) server(s), encrypting traffic, and avoiding network-level detection,” Yotam Gottesman, a Senior Security Researcher at RSA, said in a blog post. “The server address uses the pseudo-TLD “.onion” that is not resolvable outside of a TOR network and requires a TOR proxy app which is installed by the bot on the infected machine.”
“The ChewBacca Trojan appears to be a simple piece of malware that, despite its lack of sophistication and defense mechanisms, succeeded in stealing payment card information from several dozen retailers around the world in a little more than two months,” Gottesman mentioned.
The attacks have impacted no less than 41 companies, which includes one medium-sized retailer and lots of gas station chains, an RSA executive, who requested to not be named, Based on the executive, the attackers within this operation compromised credit-card data for around 50,000 customers.
To clarify, this campaign doesn’t seem to be linked by any means to the recent attack against Target Corporation.
