Threat Actor Using C&C Server to Host Ransomware, POS Carding Malware and Other Threats

guest · Nov 6, 2019

Threat Actor Using C&C Server to Host Ransomware, POS Carding Malware and Other Threats
November 5, 2019
https://securityintelligence.com/ne...omware-pos-carding-malware-and-other-threats/

Researchers at Cisco Talos found that the server hosted at least one sample of TinyPOS carding malware, a simple loader and Mimikatz. They also uncovered other tools that attackers could use to remotely connect to Windows systems and dump processes.
That being said, most of the malware files hosted on the server turned out to be samples of DoppelPaymer, a ransomware family that evolved from BitPaymer.

In its analysis of the server, Cisco Talos identified two of the threat actor’s recent targets. The first was an aluminum and steel gratings company based in the U.S., which the malicious actor targeted with ransomware. Researchers used a process dump to identify the second target, though they didn’t provide any details about the victim organization.
Growing Diversification Attempts by Attackers
The server identified by Cisco Talos factors into a larger trend where digital attackers are diversifying their malicious activities.
Click to expand...

Cisco Talos: C2 With It All: From Ransomware To Carding

CONCLUSION
This server pulls back the curtain on an active threat actor targeting and compromising different companies. The attacker is not only limited to ransomware, even if it covers the vast majority of files available on the server.

The adversary can steal credit card information via a point-of-sale malware and remotely managed compromised infrastructure. Based on the victims in this case, we can conclude that this attacker wants to target medium-sized companies in the industrial space.
This is a good example of how an attacker can be diverse during their use of infrastructure and their use of different tools, techniques and procedures (TTPs).
Click to expand...

Log in or Sign up

Threat Actor Using C&C Server to Host Ransomware, POS Carding Malware and Other Threats

guest Guest

Log in or Sign up

Threat Actor Using C&C Server to Host Ransomware, POS Carding Malware and Other Threats

guest Guest

Useful Searches