Brazilian Prilex Hackers Resurfaced With Sophisticated Point-of-Sale Malware

A Brazilian risk actor recognised as Prilex has resurfaced soon after a yr-very long operational hiatus with an sophisticated and intricate malware to steal income by implies of fraudulent transactions.

“The Prilex group has demonstrated a large degree of expertise about credit rating and debit card transactions, and how application utilized for payment processing is effective,” Kaspersky researchers explained. “This allows the attackers to keep updating their applications in buy to uncover a way to circumvent the authorization guidelines, letting them to conduct their assaults.”

The cybercrime group emerged on the scene with ATM-targeted malware attacks in the South American country, offering it the capacity to crack into ATM equipment to execute jackpotting – a type of attack aiming to dispense money illegitimately – and clone countless numbers of credit score cards to steal resources from the qualified bank’s consumers.

Prilex’s modus operandi around the yrs has since evolved to just take gain of procedures relating to level-of-sale (PoS) software to intercept and modify communications with electronic products these as PIN pads, which are utilized to aid payments applying debit or credit cards.

Identified to be energetic given that 2014, the operators are also adept at carrying out EMV replay attacks in which targeted traffic from a genuine EMV-based chip card transaction is captured and replayed to a payment processor like Mastercard, but with the transaction fields modified to incorporate stolen card details.

Infecting a pc with PoS software program installed is a highly-qualified attack incorporating a social engineering component that permits the risk actor to deploy the malware.

“A concentrate on small business may perhaps receive a connect with from a ‘technician’ who insists that the organization requirements to update its PoS program,” the scientists mentioned. “The faux technician could visit the focus on in human being or ask for the victims to put in AnyDesk and give distant obtain for the ‘technician’ to install the malware.”

The hottest installments noticed in 2022, however, exhibit 1 critical difference in that the replay attacks have been substituted with an option method to illicitly dollars out funds making use of cryptograms generated by the victim card in the course of the in-shop payment procedure.

The method, known as GHOST transactions, includes a stealer element that grabs all communications concerning the PoS software package and the PIN pad made use of for studying the card through the transaction with the purpose of obtaining the card data.

This is subsequently transmitted to a command-and-management (C2) server, allowing the danger actor to make transactions by way of a fraudulent PoS machine registered in the name of a bogus organization.

Now, it is value pointing out that EMV chip cards use what’s identified as a cryptogram to safe cardholder data each individual time a transaction is built. This is finished so as to validate the id of the card and the acceptance from the card issuer, thus minimizing the risk of counterfeit transactions.

When previous variations of Prilex circumvented these security steps by checking the ongoing transaction to get the cryptogram and conduct a replay attack employing the collected “signature,” the GHOST attack requests for new EMV cryptograms that are place to use to comprehensive the rogue transactions.

Also baked into the malware is a backdoor module which is engineered to debug the PoS program habits and make improvements on the fly. Other backdoor commands authorize it to terminate procedures, get started and halt display captures, obtain arbitrary information from the C2 server, and execute instructions working with CMD.

Prilex is “dealing directly with the PIN pad hardware protocol as a substitute of applying bigger stage APIs, carrying out serious-time patching in target application, hooking working program libraries, messing with replies, communications and ports, and switching from a replay-dependent attack to deliver cryptograms for its GHOST transactions even from credit history playing cards protected with CHIP and PIN technology,” the researchers reported.

Found this report attention-grabbing? Adhere to THN on Facebook, Twitter  and LinkedIn to read through far more exclusive content we publish.

Some parts of this article are sourced from:
thehackernews.com