FBI Warns of New Cybercrime Threat (June 3, 2015)
Cybercriminals are using a new form of malware to steal shoppers’ personal financial data, according to an FBI alert issued to retailers last week. Known as “Punkey,” the software works by accessing uncoded payment card data found in the memory of POS system computers, according to Trustwave, the security firm that first discovered the threat. The stolen data then is posted for sale online in forums used by other criminals and ID thieves.
Last Wednesday, the FBI reportedly sent a warning to U.S. companies after Punkey was used in a recent network intrusion against an unnamed restaurant chain, where it was found on about 75 POS terminals. Once Punkey penetrates a system, it installs tools that make it difficult to detect and remove. It also can inject additional malware—a rarity for POS-based malware, according to Trustwave. The FBI alert urged security technicians to be on the lookout for the malware and ramp up their cybersecurity efforts to prevent more Punkey attacks.
POS-based data breaches have afflicted several retailers in recent years, including Target, Home Depot and Neiman Marcus. Restaurant chains have been targeted as well, with P.F. Chang’s, Dairy Queen and Jimmy John’s among those that have suffered POS attacks.
Related stories:
