A 17-page report from a computer firm hired to look into the massive data breach at Target stores provides new insight into the holiday hacking that endangered data for more than 100 million customers. 
 
 The report, from computer firm iSight, was filed to the U.S. Secret Service and obtained by NBC News. It details the type of software used in the massive hack, how it was effective and mentions regions known to have the software coding prowess to pull off this kind of digital heist. 
 
 The report however does not draw conclusions on who is ultimately responsible for the attack that scooped up credit and debit card data for tens of millions of customers, citing an active U.S. government investigation. 
 
 The data breach was caused by a type of malware, similar to a computer virus, placed in a store's point-of-sale systems, it said. 
 
 "While some components of the breach operation were technically sophisticated, the operational sophistication of the compromise activity makes this case stand out," according to the iSight report. "The intrusion operators displayed innovation and a high degree of skill in orchestrating the various components of the activity." 
 
 The report details specific regions where software capabilities exist to create the malware. 
 
 "Memory scraping capabilities has been available in the Russian-language underground for some time," the report reads. "While Eastern Europe has been the focal point for POS malware development and use, cyber criminals in Brazil have used the technique since at least 2009. Globally, this trend will probably continue because malware offers important cost and risk advantages over hardware skimming techniques." 
 
 Here's how the malware works, according to the report: The insidious file triggers a "hook" and starts to suck up information on transactions in the memory of the cash register system or the server that controls it. Since the data on credit cards is encrypted, the system works by getting it in the authorization stage while it is in the memory of the POS system, unencrypted. 
 
 The tactic used during the Target holiday hackers is "new to eCrime," the report says, and "covertly subverts network controls and common forensic tactics to conceal all data transfers." 
 
 The report concludes that since this style of POS hacking can net big rewards for the cyber crooks with little risk, cardholders can expect more of this type of breach. 
 
 NBC News' Matthew DeLuca contributed to this report. 
 
 More from NBC News Investigations: 
 
 Follow NBC News Investigations on Twitter and Facebook 
 
 Investigate this! Read and vote on readers' story tips and suggested topics for investigation or submit your own. Click here to read more about this tool. ||||| The sign outside the Target store is seen in Arvada, Colorado January 10, 2014. 
 
 WASHINGTON The FBI has warned U.S. retailers to prepare for more cyber attacks after discovering about 20 hacking cases in the past year that involved the same kind of malicious software used against Target Corp in the holiday shopping season. 
 
 The U.S. Federal Bureau of Investigation distributed a confidential, three-page report to retail companies last week describing the risks posed by "memory-parsing" malware that infects point-of-sale (POS) systems, which include cash registers and credit-card swiping machines found in store checkout aisles. 
 
 "We believe POS malware crime will continue to grow over the near term, despite law enforcement and security firms' actions to mitigate it," said the FBI report, seen by Reuters. 
 
 "The accessibility of the malware on underground forums, the affordability of the software and the huge potential profits to be made from retail POS systems in the United States make this type of financially motivated cyber crime attractive to a wide range of actors," the FBI said. 
 
 The report was dated January 17 and entitled "Recent Cyber Intrusion Events Directed Toward Retail Firms." A spokeswoman for the FBI confirmed the agency had issued the report as part of efforts to share information about threats with the private sector. 
 
 Retail, credit card and bank industry executives have become increasingly concerned about the security of payment card networks after Target, the No. 3 U.S. retailer, last month disclosed one of the biggest retail cyber attacks in history. 
 
 The attack ran undetected for 19 days during the busy holiday shopping season and resulted in the theft of about 40 million credit and debit card records. The personal information of 70 million customers was also compromised. 
 
 Luxury retail chain Neiman Marcus has said it too was the victim of a cyber attack, and sources have told Reuters that other retail chains have also been breached. Neiman Marcus said about 1.1 million customer cards were exposed by a data breach from July 16 to October 30 last year. 
 
 In all these attacks, cyber criminals used memory-parsing software, also known as a "RAM scraper." When a customer swipes a credit or debit card, the POS terminal grabs the transaction data from the magnetic stripe and transfers it to the retailer's payment processing provider. While the data is encrypted during the process, RAM scrapers extract the information while it is in the computer's live memory, where it very briefly appears in plain text. 
 
 RAM scraping technology has been around for a long time, but its use has increased in recent years. Developers of the malware have also enhanced its features to make it more difficult to be detected by anti-virus software deployed on POS systems running Windows software. 
 
 MALWARE ON SALE UNDERGROUND 
 
 The FBI said in its report that one variant of the malicious POS software, known as Alina, included an option that allowed remote upgrades, making it tougher for corporate security teams to identify and eradicate it. The report said at least one type of malware has been offered for sale for as much as $6,000 in a "well-known" underground forum. 
 
 "The high dollar value gained from some of these compromises can encourage intruders to develop high sophistication methodologies, as well as incorporate mechanisms for the actors to remain undetected," the report said. 
 
 Asked to comment on the FBI warning, the National Retail Federation industry trade group said retailers are alert to cyber risks. 
 
 "Retailers have been and remain vigilant in their efforts to provide the highest level of security for their data systems in order to protect against malicious and criminal acts," NRF Vice President Tom Litchford said in a statement. 
 
 "As the criminal investigation continues and more information becomes available, you can be sure that the retail industry will be responsive and engaged to ensure this particular cyber-attack does not happen again." 
 
 One cyber security consultant who has reviewed the FBI report, said the findings were troubling. 
 
 "Everybody we work with in the retail space is scared to death because they don't have a lot of defenses to prepare against these types of attacks," said the consultant, who is advising several retailers in current investigations. 
 
 "This is not just based on anybody saying 'This is going to happen.' This is based on statistical data that the FBI is seeing," said the consultant, who was not authorized to publicly comment on the details of the report. 
 
 Retailers need to move quickly to get better tools in their networks that can analyze traffic patterns on the fly and identify any unusual activity, said another expert in retail security, who has audited POS systems to find vulnerabilities that hackers can exploit. 
 
 The expert said it is more difficult for small-to-mid sized retailers to do this because they do not have as much money and expertise as major retailers. 
 
 The FBI report said the bulk of the POS malware cases that the agency has investigated involve small-to-mid sized local or regional businesses, whose estimated losses each range from tens of thousands of dollars to millions of dollars. 
 
 The United States Secret Service usually takes the lead in credit card breach investigations for the federal government, though the FBI sometimes opens its own cases or asked to assist. The Secret Service is leading the investigations into the breaches at Target and Neiman Marcus. 
 
 A spokesman for the Secret Service declined to comment on the FBI report to retailers. 
 
 (Reporting by Jim Finkle and Mark Hosenball; Editing by Tiffany Wu and Grant McCool) ||||| Photo Advertisement Continue reading the main story 
 
 
 
 
 
 
 
 SAN FRANCISCO — In the last year, Eastern European cybercriminals have stolen Brian Krebs’s identity a half dozen times, brought down his website, included his name and some unpleasant epithets in their malware code, sent fecal matter and heroin to his doorstep, and called a SWAT team to his home just as his mother was arriving for dinner. 
 
 “I can’t imagine what my neighbors think of me,” he said dryly. 
 
 Mr. Krebs, 41, tries to write pieces that cannot be found elsewhere. His widely read cybersecurity blog, Krebs on Security, covers a particularly dark corner of the Internet: profit-seeking cybercriminals, many based in Eastern Europe, who make billions off pharmaceutical sales, malware, spam, frauds and heists like the recent ones that Mr. Krebs was first to uncover at Adobe, Target and Neiman Marcus. 
 
 He covers this niche with much the same tenacity of his subjects, earning him their respect and occasional ire. 
 
 Mr. Krebs — a former reporter at The Washington Post who taught himself to read Russian while jogging on his treadmill and who blogs with a 12-gauge shotgun by his side — is so entrenched in the digital underground that he is on a first-name basis with some of Russia’s major cybercriminals. Many call him regularly, leak him documents about their rivals, and try to bribe and threaten him to keep their names and dealings off his blog. 
 
 Continue reading the main story Uncovering Hacks Brian Krebs has made a habit of exposing breaches on his widely read cybersecurity blog. May. 1, 2010 00:00 AM Begins reporting on an escalating tussle between two major Russian cybercriminals that ultimately led to one of them being sentenced to two and half years in a Russian penal colony. Jul. 1, 2010 00:00 AM First reports on the computer worm that is later called Stuxnet, which wiped out roughly a fifth of Iran’s nuclear centrifuges and helped delay Tehran’s ability to make its first nuclear arms. Mar. 1, 2012 00:00 AM Uncovers a breach at Global Payments, which helps Visa and MasterCard process transactions for merchants. It acts as the plumbing from merchants to banks. Mar. 1, 2013 00:00 AM Exposes a Russian website that sells information that can be used for identity theft. On the site, driver's license records cost $4 each, Mr. Krebs says. He says that the exposure later prompts hackers to attack his website. Dec. 1, 2013 00:00 AM Uncovers that Target is the victim of a sophisticated cyberattack that exposes payment information for up to 110 million customers. The attackers are able to enter Target's systems through the company's heating and cooling software. Jan. 1, 2014 00:00 AM Exposing a wider breach of retail stores, reports that Neiman Marcus and Michaels, the arts and crafts retailer, are also victims of cyberattacks on their in-store cash register systems. 
 
 His clean-cut looks and plain-speaking demeanor seem more appropriate for a real-estate broker than a man who spends most of his waking hours studying the Internet’s underbelly. But few have done more to shed light on the digital underground than Mr. Krebs. 
 
 His obsession with hackers kicked in when he was just another victim. In 2001, a computer worm — a malicious software program that can spread quickly — locked him out of his home computer. “It felt like someone had broken into my home,” Mr. Krebs recalled in an interview. He started looking into it. And he kept looking, learning about spam, computer worms and the underground industry behind it. 
 
 Eventually, his anger and curiosity turned into a full-time beat at The Post and then on his own blog. 
 
 “I realized that if security breaks down, the technology breaks down,” Mr. Krebs said. 
 
 Today, he maintains extensive files on criminal syndicates and their tools. Some security experts readily acknowledge that he knows more about Russia’s digital underground than they do. 
 
 “I would put him up against the best threat intelligence analyst,” said Rodney Joffe, senior vice president at Neustar, an Internet infrastructure firm. “Many of us in the industry go to him to help us understand what the Eastern European criminals are doing, how they work with each other and who is doing what to whom.” 
 
 That proved the case in December when Mr. Krebs uncovered what could be the biggest known Internet credit-card heist. That month, he had been poking around private, underground forums where criminals were bragging about a fresh haul of credit and debit cards. 
 
 Advertisement Continue reading the main story 
 
 Soon after, one of Mr. Krebs’s banking sources called to report a high number of fraudulent purchases and asked whether Mr. Krebs could pinpoint where they were coming from. The source said that he had bought a large batch of stolen cards from an underground site and that they all appeared to have been used at Target. 
 
 Mr. Krebs checked with a source at a second bank that had also been dealing with a spike in fraud. Together, they visited one forum and bought a batch of stolen cards. Again, the cards appeared to have one thing in common: They had been used at Target from late November to mid-December. 
 
 On the morning of Dec. 18, Mr. Krebs called Target. The company’s spokeswoman did not return his call until several hours later, but by then he had enough to run his article: Criminals had breached the registers in Target’s stores and had made off with tens of millions of payment card numbers. 
 
 In the following weeks, Mr. Krebs discovered breaches at Neiman Marcus; Michaels, the arts and crafts retailer; and White Lodging, which manages franchises for major hotel chains like Hilton, Marriott and Starwood Hotels. 
 
 It is still unclear whether the attacks were related, but at least 10 other retailers may have been hit by the same hackers that hit Target and are reluctant to acknowledge it. 
 
 That is where Mr. Krebs comes in. Unlike physical crime — a bank robbery, for example, quickly becomes public — online thefts are hushed up by companies that worry the disclosure will inflict more damage than the theft, allowing hackers to raid multiple companies before consumers hear about it. 
 
 “There’s a lot going on in this industry that impedes the flow of information,” Mr. Krebs said. “And there’s a lot of money to be made in having intelligence and information about what’s going on in the underworld. It’s big business but most people don’t want to pay for it, which explains why they come to someone like me.” 
 
 Mr. Krebs is “doing the security industry an enormous favor by disseminating real-time threat information,” said Barmak Meftah, chief executive of AlienVault, a threat-detection service. “We are only as strong as our information. Unless we are very specific and effective about exchanging threat data when one of us gets breached, we will always be a step behind the attackers.” 
 
 Photo 
 
 The tally of victims from the breaches at Target, Neiman Marcus and others now exceeds one-third of the United States population — a grim factoid that may offer Mr. Krebs a strange sense of career vindication. 
 
 He first developed an interest in computers because his father, an Air Force engineer, was obsessed with the latest devices. But he did little about it until 1998, when he began writing about technology for The Post, after working his way up from the mailroom. Cybersecurity became a bit of a focus after his own computer was infected by that worm in 2001. “I learned there’s this whole underworld that seemed really fascinating,” he said. 
 
 In 2005, he started The Post’s Security Fix blog, occasionally frustrating editors with hacker jargon and unnerving some who worried he was becoming too close to sources. 
 
 Advertisement Continue reading the main story 
 
 Advertisement Continue reading the main story 
 
 “A lot of what Brian does would scare the hell out of traditional newsroom editors,” said Russ Walker, Mr. Krebs’s former editor at The Post. “I don’t think he crossed the lines journalistically, but he was living a different type of experience.” 
 
 By 2006, Mr. Krebs was a fixture in hacker forums, learning code, and — ever the dutiful reporter — borrowing Russian language tapes from his local library since most of what he tracks originates in the former Soviet Union and its satellite states. (He acknowledges having used his technical prowess at one point to peek inside The Post’s payroll system to see how much colleagues were making, something he now strongly advises against.) 
 
 Advertisement Continue reading the main story 
 
 In 2009, The Post asked Mr. Krebs to broaden his focus to general technology news and policy. When he declined, he was let go. 
 
 He used his severance to start his own blog, Krebs on Security, from his “command center,” a guest room at the Annandale, Va., home he shares with his wife. There, three 19-inch computer screens help him keep tabs on the underworld, while another monitors security footage of his house. 
 
 Mr. Krebs’s readership is growing. In December, 850,000 readers visited his blog, mostly to learn more about the breach at Target. Though he will not disclose figures, Mr. Krebs says the salary he now makes from advertising, occasional speaking engagements and consulting work is a “nice bump” from what he earned at The Post. 
 
 But there are risks implicit to being a one-man operation. “The work that he’s done exposing Eastern European hackers has been seminal,” said Tom Kellermann, a cybersecurity expert who is a managing director at Alvarez and Marsal, a turnaround firm. “But Brian needs a bodyguard.” 
 
 Russian criminals routinely feed Mr. Krebs information about their rivals that they obtained through hacks. After one such episode, he began receiving daily calls from a major Russian cybercriminal seeking his files back. Mr. Krebs is writing a book about the ordeal, called “Spam Nation,” to be published by Sourcebooks this year. 
 
 In the meantime, hackers have been competing in a dangerous game of one-upmanship to see who can pull the worst prank on Mr. Krebs. They often steal his identity. One opened a $20,000 credit line in his name. Admirers have made more than $1,000 in bogus PayPal donations to his blog using hacked accounts. Others have paid his cable bill for three years with stolen credit cards. 
 
 The antics can be dangerous. In March, as Mr. Krebs was preparing to have his mother over for dinner, he opened his front door to find a police SWAT team pointing semiautomatic guns in his direction. Only after his wife returned home from the grocery store to find him handcuffed did the police realize Mr. Krebs had been the victim of “swatting.” Someone had called the police and falsely reported a murder at their home. 
 
 Four months after that, someone sent packets of heroin to Mr. Krebs’s home, then spoofed a call from his neighbor to the police. But Mr. Krebs had already been tipped off to the prank. He was tracking the fraud in a private forum — where a criminal had posted the shipment’s tracking number — and had alerted the local police and the F.B.I. 
 
 Mr. Joffe worries Mr. Krebs’s enemies could do far worse. “I don’t understand why he hasn’t moved to a new, undisclosed address,” he said. 
 
 Mr. Krebs said he did plan to move and keep his new address secret. But these days it is almost impossible. 
 
 Though he goes to great lengths to protect his personal information, last month his wife received an email from Target informing her that their mailing address and other personal information had been stolen in the breach. 
 
 “I got that letter,” he said, “and I just had to laugh.”
– It looks like the hackers that hit Target had lots of other, well, targets. The Department of Homeland Security recently sent retailers and financial service companies a secret memo warning that the Target hit appeared to be part of a larger international campaign, the Wall Street Journal reports, an insight gleaned with the help of Dallas cybersecurity firm iSight Partners. Yesterday, iSight released its own report, saying that a virus it's calling KAPTOXA "has potentially infected a large number of retail information systems"—and noting that the "intrusion operators displayed innovation and a high degree of skill," particularly in terms of the "operational sophistication" of the hack. The Journal shares this feature by way of example: The virus focused on stealing data during the peak hours of 10am and 5pm; the data was housed in a Target server that the hackers later accessed. The virus attacks point-of-sale systems in a way that is "new to eCrime," subverting traditional efforts to protect consumer data, the report warns, according to NBC. Parts of the code, which is impervious to all known antivirus software, have been online since last spring. It's partly in Russian, which US officials think may indicate a link to organized crime in the former Soviet Union. The finding follows reports of similar breaches at Neiman Marcus. That breach had gone unnoticed since July, the New York Times reports today; Neiman's system was only fully secured Sunday.