In a notorious POS attack, the personal information of about 40 million Target customers and 56 million Home Depot customers was taken, ascribed to the deployment of a new spyware software known as BlackPOS. For playing a role in the major breach hitting one of the largest U.S. merchants between Nov. 27 and Dec. 15, 2013, BlackPOS is arguably the most well-known POS RAM scraper.
BlackPOS is an old malware program discovered in mid-2012. Its source code was released online at some point, resulting in multiple BlackPOS versions with varying capabilities. Attackers used a BlackPOS version to steal the payment card information of 70 million consumers throughout the U.S. The thieves were expected to earn $53.7 million by selling the stolen cards and other consumer data.
RAM scrapers are being replaced by more sophisticated forms of malware such as screen grabbers and keyboard loggers. But RAM scrapers are still prevalent in attacks, as these malware programs are designed to gather personal information shown or inputted and then pass on the data to a third party. RAM-scraping malware generally targets companies and businesses rather than regular desktop and laptop PCs. The data is susceptible when kept in the back-end server’s system memory (RAM) that processes the transaction.