Thursday, March 28, 2024

Upgraded TrickBot Malware Attack Point-of-Sale Machines & Services to Steal Credit/Debit card Data

Trickbot, a Banking Trojan that involved various cyber attacks especially target the banking networks, now distributing to target the POS services and machines to steal credit cards and ATM cards bank related sensitive data.

Recently TrickBot’s malicious activities on various browsers and apps such as  Microsoft Outlook, Chrome, Firefox, IE, Edge to Steal Password & Other Sensitive Data.

Also, malware authors keeps added new futures including powerful code injection technique to evade the detection, anti-analysis technique and disable the security tools that run in the target victims computer.

Currently identified the version of Trickbot scanning for indicators of the network that provide POS related services.

A new POS infection module, psfin32 is similar to network domain harvesting module that it was used in previous attacks.

Researchers discovered POS-related terms in the module and it uses LDAP queries to access Active Directory Services (ADS) to Identifying the POS services in a network.

LDAP queries & TrickBot Infection Process

LDAP queries mainly used for searching machines that containing the Following substrings related to POS in the Global Catalog.

*POS* *LANE* *BOH* *TERM**REG* *STORE* *ALOHA* *CASH* *RETAIL* *MICROS*

It using the different LDAP queries to search the substrings and if the query does not resolve any of the requested information, it also performs other queries for different accounts or objects .

Once the Trickbot obtain the information from the target then it stored the data in pre configured file and share it into C&C server ia POST connection.

if suppose C&C server not reachable then it prompt “Dpost servers unavailable,” else it respond as  “Report successfully sent.”

According to Trend Micro Research, “Considering the module’s timing for deployment, the threat actors may be leveraging the holidays to gather information and distribution, especially after a similar entry by Brad Duncan published in ISC talked about a malspam campaign involving TrickBot macros targeting the United States.”

In this case, users and businesses are warned against opening suspicious emails, files and attachments to prevent such attacks in the future.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can check the Vulnerability Management Analysis to keep your self-updated.

Website

Latest articles

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles