BlackPOS
BlackPOS, also known as Kaptoxa, is point-of-sale malware designed to be installed on Windows-based POS systems to scrape debit and credit card data from process memory. The content states it first surfaced in early 2013 and was used in major retail breaches, most notably the 2013 Target Corporation incident; Neiman Marcus is also cited as affected, and Australia, the United States, and Canada are mentioned as impacted geographies. BlackPOS infects Microsoft Windows computers with attached card readers, attaches to the pos.exe process, and scans memory for Track 1 and Track 2 payment card data. Stolen data is staged internally via SMB to a server within the victim environment, and a separate component then sends the data to the attacker via FTP. The malware is described as transmitting stolen information during business hours to reduce suspicion. The content attributes the original creation of BlackPOS to Rinat Shabayev and later development and underground sale to Sergey Taraspov, alias "ree4," including sale under the name "Dump Memory Grabber by Ree" for about $2,000. The name "BlackPOS" is noted as appearing in the malware's administration panel. BlackPOS is also explicitly referenced as an example of POS malware used to steal card data in the broader payment-card cybercrime ecosystem.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Credential Access
1 technique
Credential Access
The class of malware identified by Krebs is often referred to as a memory scraper, because it monitors the computer memory of POS terminals used by retailers. The malware searches for credit card data before it has been encrypted and sent to remote payment processors. The malware then “scrapes” the plain-text entries and dumps them into a database. | The malware searches for credit card data before it has been encrypted and sent to remote payment processors. The malware then “scrapes” the plain-text entries and dumps them into a database.
Lateral Movement
2 techniques
Lateral Movement
Collection
1 technique
Collection
The class of malware identified by Krebs is often referred to as a memory scraper, because it monitors the computer memory of POS terminals used by retailers. The malware searches for credit card data before it has been encrypted and sent to remote payment processors. The malware then “scrapes” the plain-text entries and dumps them into a database. | The malware searches for credit card data before it has been encrypted and sent to remote payment processors. The malware then “scrapes” the plain-text entries and dumps them into a database.
Exfiltration
2 techniques
Exfiltration
Other
1 technique
Other
At the time this POS malware was installed in Target’s environment ... none of the 40-plus commercial antivirus tools used to scan malware at virustotal.com flagged the POS malware ... as malicious. “They were customized to avoid detection and for use in specific environments,” the source said.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Point-of-sale (POS) malware used to compromise payment environments and steal payment card data from POS systems.
It was discovered in September 2015 along with other kinds of POS malware, such as NewPOSThings, BlackPOS, and Alina.
It was discovered in September 2015 along with other kinds of POS malware, such as NewPOSThings, BlackPOS, and Alina.
POS memory-scraping malware for Windows that attaches to the POS process (pos.exe), scans memory for payment card Track 1/Track 2 data, stages/exfiltrates stolen card data internally over SMB and then out to attackers via FTP, and times exfiltration to business hours to reduce suspicion.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.