Unknown POS

Date (as written): 2017-12
Year: 2017
Country: Korea, Republic of
Actors (as written): Lazarus
Actor pages: Lazarus
Tags (as written): Finance DataBreach

Source entries (4)

lazarus.day

Unknown POS · 2017-12

Proofpoint described RatankbaPOS as part of financially motivated Lazarus Group activity centered on cryptocurrency and POS-related malware operations. The reporting connected RatankbaPOS with PowerRatankba downloaders, multiple delivery formats including shortcut, CHM, Office macro, and backdoored PyInstaller payloads, and related second-stage tooling such as PowerRatankba.B and Gh0st RAT, with attribution supported by shared encryption, obfuscation, functionality, decoys, code overlap, and C2 characteristics.

https://lazarus.day/incidents/ratankbapos/

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Unknown POS · 2017-12

Reported: 2017-12; Victims: Unknown POS; Motivations: DataBreach; Sectors: Finance; Countries: Korea, Republic of

https://data.mendeley.com/datasets/wwb2rzgfn7/2

Hackmageddon cyber attacks timelines (Paolo Passeri)

Single Individuals · 21/12/2017

Proofpoint researchers uncover what it’s calling the first publicly documented instance of a nation-state targeting a POS-related framework for the theft of credit-card data, carried out by the notorious Lazarus Group hacking arm of Pyongyang.

https://www.hackmageddon.com/2018/01/03/16-31-december-2017-cyber-attacks-timeline/

https://www.infosecurity-magazine.com/news/north-korea-begins-pos-attacks/

Proofpoint Threat Insight

Lazarus Group targeting of a point-of-sale related framework for credit card theft · report file dated 180129

We also share our discovery of what may be the first publicly documented instance of a state targeting a point-of-sale related framework for the theft of credit card data, again using a variant of malware that is closely related to PowerRatankba.

https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug-180129.pdf

Suggest a correction on GitHub