Pierluigi Paganini June 26, 2016

Experts are continuing to monitor the PunKeyPos malware in the wild, the threat might have already stolen millions of payment card numbers.

Experts are continuing to monitor the PunKeyPos malware in the wild, the threat might have already stolen millions of payment card numbers.

Security experts from PandaLabs spotted a new strain of the PoS malware dubbed PunkeyPos which seems to be used by multiple criminal crews in the wild, likely it could be involved in malware-as-a-service model.

Experts have classified it as the successor of the NewPOSthings malware family of malware, it is designed to scan an infected host to steal payment card data.RAM-scraper.

PunkeyPos was already active in 2015 when experts from Trustwave discovered the threat investigating incidents occurred in a number of organizations.

They noticed the malicious code implements reconnaissance and hacking abilities, including the implementation of a Keylogger module used to steal user data.

PunkeyPOS traffic is encrypted with AES algorithm, it is able to infect machines running all current Windows OSs. According to the experts since its first apparition, the threat already infected many organizations around the US and might have stolen millions of payment card numbers.

The popular investigator Brian Krebs confirmed that the PunkeyPos variant has already stolen over 1.2 million unique payment card data since early April 2016.

“Only about half of the 1.2 million stolen accounts appear to have been taken from compromised CiCi’s locations. The majority of the other Internet addresses that appear in the bot logs could not be traced back to specific establishments. Others seem to be tied to individual businesses, including a cinema in Wallingford, Ct., a pizza establishment in Chicago (the famous Lou Malnatis), a hotel in Pennsylvania, and a restaurant at a Holiday Inn hotel in Washington, D.C.” wrote Krebs.

According to PandaLabs, roughly 200 PoS were infected by this variant of PunkeyPoS, with most of the victims in the US, other cases were obserbed in Europe, S. Korea and Australia.

“PunkeyPOS runs seamlessly in all Windows operating systems. The cyber-criminal’s plan is to install the malware in POS terminals in order to steal sensitive information such as account numbers, magnetic strip contents (tracks) from bank cards, etc.” reported an analysis published by PandaLabs. 

The malware experts discovered the C&C address through reverse engineering or analyzing malicious traffic. Below the home page of the PunkeyPoS control panel shared by PandaLabs.

The admin panel appears easy to use and allows attackers to monitor the infections and update the threat agent.

The experts believe that the malware was spread anonymously through the internet, for example through phishing campaigns.

“Taking into account how easy it is to sell this information on the black market, and how convenient it is to compromise these PoS terminals anonymously through the internet, we are certain that cyber-criminals will be increasingly drawn to these terminals,” concluded PandaLabs.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs –  PunkeyPoS malware)