BlackPOS
BlackPOS, also known as Kaptoxa, is a point-of-sale malware program designed to be installed in a point of sale (POS) system to scrape data from debit and credit cards. BlackPOS was used in the Target Corporation data breach of 2013. History The BlackPOS program first surfaced in early 2013 and affected many Australian, American, and Canadian companies using point-of-sale systems, such as Target and Neiman Marcus. The program was originally created by 23 year-old Rinat Shabayev and later developed by 17-year-old Sergey Taraspov, better known by his online name, 'ree4'. The original version of BlackPOS was sold on online black market forums by Taraspov, under the name "Dump Memory Grabber by Ree", for around $2000. The name BlackPOS was found in the software's administration panel. Operation BlackPOS infects computers running on Microsoft Windows that have credit card readers connected to them and are part of a POS system. After installation, the program attaches to the pos.exe process and scans its memory for track 1 and track 2 payment card data. The data is then exfiltrated via SMB to a server within the company, where another component collects it and sends it to the attacker via FTP. BlackPOS only sends stolen