Point-of-Sale (POS) is not a new malware. On the other side, Alina malware, which cybercriminals use to scrape credit card numbers from POS systems, has been around for many years. New intelligence from CenturyLink’s Black Lotus Labs, however, revealed that criminals are not yet done with Alina, and they continue to find new ways to use it to steal unsuspecting victims’ credit card and debit card data.
POS malware continues to pose a serious security threat
The theft was discovered after one of Black Lotus Labs‘ machine-learning models flagged unusual queries to a specific domain in April 2020. Rigorous research determined that the Alina POS malware was utilizing Domain Name System (DNS) – the function that converts a website name into an IP address – as the outbound communication channel through which the stolen data was infiltrated.
Mike Benjamin, head of Black Lotus Labs said,
“Black Lotus Labs is releasing this intelligence in support of our mission to leverage our global network visibility to protect our customers and keep the internet clean. We will continue to monitor this situation as we work to eliminate the threat. We strongly recommend that all organizations monitor DNS traffic for suspicious queries to prevent this and other threats.”
POS malware continues to pose a serious security threat, and DNS is a popular choice for malware authors to bypass security controls and exfiltrate data from protected networks. Malicious actors regularly update their Tactics, Techniques and Procedures (TTPs) to evade detection, so the best defense is continuous monitoring for anomalous behavior.
Why DNS is important
Credit card processing systems typically run in Windows environments, allowing them to be targeted by the existing skills of the crimeware markets. Although credit card processing occurs in highly restricted environments, DNS often goes unmonitored, which makes it an attractive choice for the exfiltration of credit card information.
To do this, malware authors encode the stolen information and issue a DNS query to the actor-controlled domain name. The encoded data is placed in a subdomain, which the malicious actors then extract when they receive the DNS query. The stolen data is subsequently sold in underground criminal markets.