DMSniff POS Malware has flown under the radar for at least four years

Malware researchers at Flashpoint revealed that at least since 2016, a PoS malware dubbed DMSniff has flown under the radar.

Malware researchers at Flashpoint revealed that since 2016, a PoS malware dubbed DMSniff has been involved in breaches of small- and medium-sized businesses in the restaurant and entertainment industries.

DMSniff leverages a domain generation algorithm to create command-and-control domains on the fly, a technical choice that make it hard takedown of C2 infrastructure by law enforcement and that is uncommon for PoS malware.
DMSniff will loop between multiple top-level domains (TLDs) until it manages to find a command-and-control server (C&C) to connect with.
DMSniff uses multiple techniques to protect itself and the C2 communications, including a simple string-encoding routine that hides strings associated with the malware.

“Point-of-sale malware previously only privately sold has been used in breaches of small- and medium-sized businesses in the restaurant and entertainment industries. The malware, known as DMSniff, also uses a domain generation algorithm (DGA) to create lists of command-and-control domains on the fly. ” reads the analysis published by Flashpoint.

DMSniff remained under the radar for at least four years, attackers use to drop the PoS malware on the devices either by using brute-force attacks against SSH connections, or by exploiting vulnerabilities.

In order to steal credit card data from the POS systems, the malware search for interesting process and loops through the memory sections to attempt to find credit card data.

“Each time it finds an interesting process, it will loop through the memory sections to attempt to find a credit card number.” continues the analysis. “Once a number is found, the bot will take the card data and some of the surrounding memory, packages it, and sends it to the C2.”

Further details about the DMSniff, including indicators of compromise (IoCs), are reported in the analysis published by Flashpoint.

“DMSniff is another name in a growing list of evolving threats for the point-of-sale malware world. During our research we found that this malware was primarily utilized to target small to medium sized businesses such as restaurants and theaters.” concludes the experts. “It also contains a domain generation algorithm, something that is rare to see in point-of-sale malware”

Pierluigi Paganini