Security researchers have discovered a new Point-of-sale malware known as “GamaPoS”. This memory scraping malware program is distributed by a large botnet known as Andromeda. GamaPoS was recently discovered by security researchers from antivirus vendor Trend Micro, who found systems infected with it inside organizations from 13 U.S. states and Vancouver, Canada. The program is written in Microsoft’s .NET, which is unusual for RAM scraping malware. These types of threats monitor the memory of point-of-sale systems for payment card data and steal it while it is being passed from the physical card readers to the commerce applications. Attackers have historically infected PoS systems by stealing or guessing remote access credentials. However, the numerous PoS breaches at large retailers in recent years have prompted many organizations to secure their remote access procedures, making this attack vector less attractive for cybercriminals. However, the GamaPoS has a different approach. Instead of directly targeting PoS systems from the Internet, they are attacking from inside the trusted internal networks of companies.
The information provided herein is on "as is" basis, without warranty of any kind.
Mauritian Computer Emergency Response Team (CERT-MU)
National Computer Board
7th Floor, Stratton Court
La Poudriere Street