Reportedly, the Visa Payment Fraud Disruption (PFD) detected three such incidents on the point-of-sale (POS) systems of fuel dispenser merchants.
In the first incident, the attackers gained access to the merchant’s network via an email phishing attack. The attackers could install the system with RAT and spread laterally by obtaining credentials due to a security lapse. As explained in the notice,
There was also a lack of network segmentation between the Cardholder Data Environment (CDE) and corporate network, which enabled lateral movement.In addition the attackers also used RAM scraper to harvest payment card data.
In the second incident, it remains unknown how the attackers gained access to the target merchant’s POS network. Yet, the attackers moved laterally on the network to harvest card data, specifically targeting the mag stripe/track data.
The third incident targeted a North American hospitality merchant. According to the PFD analysis, the malware involved in this attack also linked back to the cybercrime group FIN8. They found it based on the RM3 variant of Ursnif banking Trojan.
Whereas, the IOCs of the second incident also hinted at the involvement of FIN8.
Let us know your thoughts in the comments.
