Malware researchers at Flashpoint revealed that since 2016, a
DMSniff uses multiple techniques to protect itself and the C2 communications, including a simple
“Point-of-sale malware previously only privately sold has been used in breaches of small- and medium-sized businesses in the restaurant and entertainment industries. The malware, known as DMSniff, also uses a domain generation algorithm (DGA) to create lists of command-and-control domains on the fly. ” reads the analysis published by Flashpoint.
In order to steal credit card data from the POS systems, the malware search for interesting process and loops through the memory sections to attempt to find credit card data.
“Each time it finds an interesting process, it will loop through the memory sections to attempt to find a credit card number.” continues the analysis. “Once a number is found, the bot will take the card data and some of the surrounding
Further details about the DMSniff, including indicators of compromise (IoCs), are reported in the analysis published by Flashpoint.
“DMSniff is another name in a growing list of evolving threats for the point-of-sale malware world. During our research we found that this malware was primarily utilized to target small to
(SecurityAffairs – SDMSniff point-of-sale malware