A new module has been attached to TrickBot malware that allows point-of-sale (POS) data collection capabilities.

TrickBot is a modular malware that is being developed. In early November, TrickBot was refreshed with with a password stealing module, but the latest update has made it even more dangerous, mostly for hotels, retail outlets, and restaurants: Companies that process large volumes of card payments.

The new module was discovered by security experts at Trend Micro who note that, at present, the module is not being used to capture POS data such as credit/debit card numbers. Currently, the new TrickBot malware module is only gathering data about whether an infected device is part of a network that supports POS services and the types of POS systems implemented. The experts have not yet determined how the POS information will be used, but it is highly likely that the module is being used for intelligence. Once targets with networks supporting POS systems have been discovered, they will likely be subjected to further intrusions.

The new module, labelled psfin32, is like a previous network domain harvesting module, but has been developed specifically to spot POS-related terms from domain controllers and basic accounts. The module achieves this by using LDAP queries to Active Directory Services which search for a dnsHostName that includes strings such as ‘pos’, ‘retail’, ‘store’, ‘micros’, ‘cash’, ‘reg’, ‘aloha’, ‘lane’, ‘boh’, and ‘term.’

The timing of the update suggests the threat actors are planning to use the increase in holiday trade and are gathering as much data as possible before the module is used to gather POS data.

The recent updates to TrickBot malware have been accompanied by a malicious spam email campaign (discovered by Brad Duncan) which is targeting companies in the United States. The malspam campaign uses Word documents including malicious macros that download the TrickBot binary.

Protecting against TrickBot and other data stealing malware requires a defense-in-depth approach to cybersecurity. The main attack vector used by the threat actors to blame TrickBot is spam email, so it is vital for an advanced anti-spam solution to be deployed to stop malicious messages from being sent to end users’ inboxes. End user training is also important to ensure employees are made aware of the danger of opening emails from unknown senders, launching suspicious email attachments, and clicking hyperlinks in those emails.

Antivirus solutions and endpoint security measures should also be deployed to identify and quarantine potentially malicious files in case malware makes it past perimeter security.