New Lusypos Malware for Sale in the Underground, Dec 2014 · New Lusypos Malware for Sale in the...

4
FRAUD REPORT NEW LUSYPOS MALWARE FOR SALE IN THE UNDERGROUND December, 2014 RSA recently tracked a new malware application dubbed LusyPOS advertised for sale in Russian speaking underground forums. The cybercriminal describes LusyPOS as a ‘dump grabbing’ (steals Track1/2 credit card data) POS malware that attacks POS systems based on the Windows platform. The forum post states that all sales will be done via an escrow service, and lists the following features: – Coded in C – Grabs Track 1/Track 2 of a credit card dump – Works with Windows POS systems – TOR http Admin panel – Luna checker for CC numbers – Multiple users supported Two different packages are offered, based on the technical expertise level of the cybercriminal: Pro Package (for those already experienced with ‘dump grabbers’) – All re-builds are free – Unlimited support via Jabber chat – $2,000 per binary with installation on user’s hosting – $2,200 per binary with installation on fraudster’s hosting Newbie Package (for new users) – Full help in initial setup

Transcript of New Lusypos Malware for Sale in the Underground, Dec 2014 · New Lusypos Malware for Sale in the...

Page 1: New Lusypos Malware for Sale in the Underground, Dec 2014 · New Lusypos Malware for Sale in the Underground, Dec 2014 Author: Heidi Bleau Subject: RSA recently tracked a new malware

F R A U D R E P O R T

NEW LUSYPOS MALWARE FOR SALE IN THE UNDERGROUND

December, 2014

RSA recently tracked a new malware application dubbed LusyPOS advertised for sale in

Russian speaking underground forums. The cybercriminal describes LusyPOS as a ‘dump

grabbing’ (steals Track1/2 credit card data) POS malware that attacks POS systems based

on the Windows platform.

The forum post states that all sales will be done via an escrow service, and lists the

following features:

– Coded in C

– Grabs Track 1/Track 2 of a credit card dump

– Works with Windows POS systems

– TOR http Admin panel

– Luna checker for CC numbers

– Multiple users supported

Two different packages are offered, based on the technical expertise level of the cybercriminal:

Pro Package (for those already experienced with ‘dump grabbers’)

– All re-builds are free

– Unlimited support via Jabber chat

– $2,000 per binary with installation on user’s hosting

– $2,200 per binary with installation on fraudster’s hosting

Newbie Package (for new users)

– Full help in initial setup

Page 2: New Lusypos Malware for Sale in the Underground, Dec 2014 · New Lusypos Malware for Sale in the Underground, Dec 2014 Author: Heidi Bleau Subject: RSA recently tracked a new malware

page 2R S A M O N T H LY F R A U D R E P O R T

– Fully functional and pre-configured control panel and hosted application –

ready for immediate use

– An introductory tutorial to the whole process

– Tips and additional knowledge sharing

– Additional tools for hacking POS machines at an additional price

– Online support always available. May involve an additional fee, according to the level

of knowledge/help required

The cybercriminal posted alleged screenshots of the Admin panel of the LusyPOS

malware, displaying information on currently active bots and alleged CC data that has

been stolen. We do not know at this time if any of the details shown in the screenshots

are real or contrived by the developer as part of advertising his malware kit.

It is no surprise to see the continued growth of POS malware springing up. Particulary, the

U.S. is at most risk for these opportunistic attacks as migration to the EMV standard has

just started, and most cardholders in the U.S. still carry cards that use the magnetic stripe.

However, merchants are taking notice after the flurry of high profile POS retail breaches in

the last 12 months, and investing in additional technology, such as tokenization, to protect

cardholder data as a result. In fact, two-third of merchants in a recent survey stated they are

already using or plan to implement tokenization technology in the next 12 months (see

Figure 2; Source: Aite Group).

What is your plan to deploy the following technologies?

0 10 20 30 40 50

How will cybercriminals react to the coming of EMV in the U.S.? It is likely we will see a

rapid growth in POS malware variants in 2015 as cybercriminals look for opportunistic

attacks to steal massive caches of card data before EMV becomes the standard for all

U.S. payment cards.

Figure 1: Admin panel Overview

screen posted by the fraudster –

allegedly showing number of bots,

and total number of CC ‘dumps’.

Figure 2: Top of mind security

solutions for retailers looking to

add protection for cardholder data.

Tokenization (n=26)

3-D Secure (n=20)

44%

22%

3%

13%

22%

22%

16%

3%

Using today

On the 1- to 2- year roadmap

Plan to use, but not in the next 2 years

No plans to use

Page 3: New Lusypos Malware for Sale in the Underground, Dec 2014 · New Lusypos Malware for Sale in the Underground, Dec 2014 Author: Heidi Bleau Subject: RSA recently tracked a new malware

page 3R S A M O N T H LY F R A U D R E P O R T

Phishing Attacks per Month

RSA identified 61,278 phishing attacks in

November, marking a 76% increase from

October. This sharp increase is no surprise

due to the high volumes of online shopping

during the holiday season. Based on this

figure, RSA estimates phishing cost global

organizations $594 million in losses.

US Bank Types Attacked

Regional banks and credit unions were

targeted by half of all phishing volume in

November. Phishing volumes have started to

even out as cybercriminals look to target

smaller financial institutions that might not

have the resources to address these attacks.

Top Countries by Attack Volume

The U.S accounted for nearly 75% of attack

volume in November, followed by the UK,

Cananda and South Africa.

61,278 Attacks

Credit Unions

Regional

National

74%

9%

4%

3%

Canada

South Africa

UK

U.S.

DECEMBER 2014Source: RSA Anti-Fraud Command Center

Page 4: New Lusypos Malware for Sale in the Underground, Dec 2014 · New Lusypos Malware for Sale in the Underground, Dec 2014 Author: Heidi Bleau Subject: RSA recently tracked a new malware

www.emc.com/rsa

CONTACT USTo learn more about how RSA products, services, and solutions help solve your business and IT challenges contact your local representative or authorized reseller – or visit us at www.emc.com/rsa

Top Hosting Countries

Ten percent of all phishing attacks were

hosted in Latin America in November,

specifically Argentina, Colombia, and

Brazil.

4%5% 4%

50%

GLOBAL PHISHING LOSSESNOVEMBER 2014

©2014 EMC Corporation. EMC, RSA, the RSA logo, and FraudAction are trademarks or registered trademarks of EMC

Corporation in the U.S. and/or other countries. All other trademarks mentioned are the property of their respective

holders. DEC RPT 1214


Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware & Anti-Malware

Malware & Anti-Malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

The Use of Malware Analysis in Support of Law …...As with traditional adversarial tools, malware can be either built from scratch or purchased in the underground economy. The sale

The Use of Malware Analysis in Support of Law …...As with traditional adversarial tools, malware can be either built from scratch or purchased in the underground economy. The sale

Mobile Threats and the Underground Marketplace - APWGdocs.apwg.org/reports/mobile/apwg_mobile_fraud_report_april_2013.pdf · Mobile Threats and the Underground ... Types of malware

Mobile Threats and the Underground Marketplace - APWGdocs.apwg.org/reports/mobile/apwg_mobile_fraud_report_april_2013.pdf · Mobile Threats and the Underground ... Types of malware

The Underground Railroad UNDERGROUND RAILROAD UNDERGROUND RAILROAD.

The Underground Railroad UNDERGROUND RAILROAD UNDERGROUND RAILROAD.

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do.

1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do.

Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox analysis

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

TWC: Frontier: Collaborative: Beyond Technical Security: … · on demand for $8 per thousand [31]. New malware is bought and sold, underground consultants ply their clients with

TWC: Frontier: Collaborative: Beyond Technical Security: … · on demand for $8 per thousand [31]. New malware is bought and sold, underground consultants ply their clients with

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Metamorphic Malware 1 Metamorphic Malware Research.

Metamorphic Malware 1 Metamorphic Malware Research.

CYBER THREAT INTELLIGENCE - Happiest Minds · Customer mentions on Social Media, Underground Forum and auction of credit/debit card ,PI data, Company data targeted malware attacks.

CYBER THREAT INTELLIGENCE - Happiest Minds · Customer mentions on Social Media, Underground Forum and auction of credit/debit card ,PI data, Company data targeted malware attacks.

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

brochure fontaine bleau

brochure fontaine bleau

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,