Target Malware Allegedly Written by Russian Pair

A security firm has identified two Russians as the creators of the malware behind the attack on Target that netted personal information on as many as 110 million Target customers. But the firm has also said that the attack, and possibly additional attacks, appears to have been carried out by others.

IntelCrawler, a security firm headquartered in Sherman Oaks, Calif., issued a statement on Friday that the identified BlackPOS malware may have also been used against as many as six other retailers. Recent news reports indicate that retailer Neiman Marcus has also suffered a security breach, and the U.S. Department of Homeland Security has warned about similar attacks targeting individual point-of-sale terminals.

KAPTOXA Malware

On Thursday, security company iSIGHT Partners, working with the U.S. Secret Service, announced it has determined that a new malicious software, called KAPTOXA and pronounced Kar-Toe-Sha, "has potentially infected a large number of retail information systems."

In a joint statement by Homeland Security, the Secret Service, the Financial Services Information Sharing and Analysis Center (FS-ISAC) and iSIGHT Partners, the organizations said that any company or institution with a point-of-sale system "may be at risk." A copy of the report is available from iSIGHT Partners.

On Friday, researchers at IntelCrawler first said the age of the BlackPOS malware author was about 17, that he often employs the username "ree4," and that he is based in St. Petersburg. The teen, whom they identified as Sergey Tarasov, is allegedly known in the underground as a prolific creator of malware.

The company also said it had determined that BlackPOS was first developed in March of last year, and that its original name was Kaptoxa, Russian slang for a potato. The security firm said more than 40 builds of the malware have been sold for about $2,000 each to cybercriminals in Eastern Europe...

Comments are closed.