Point of Sale (PoS) systems belonging to at least two North American gas station merchants and a hospitality chain have been attacked over the last few months by what Visa this week described as sophisticated cybercrime groups looking to harvest payment card data.

Unlike card theft operations where criminals attach hidden skimmers to card readers at gas pumps and other PoS systems, the latest attacks have involved the use of malware on the backend systems that merchants use to process card transactions. As a result, the attacks were a lot more sophisticated, Visa said in an alert.

"It is important to note that this attack vector differs significantly from skimming at fuel pumps, as the targeting of POS systems requires the threat actors to access the merchant’s internal network, and takes more technical prowess than skimming attacks," Visa's alert said.

Visa's payment fraud division have identified at least three separate attacks targeting PoS systems since August. Two of them appear to have been carried out by FIN8, a threat group that has previously been associated with numerous attacks on PoS systems.

In one of the attacks that Visa identified this summer, the breach began when an employee at one of the gas station chains that was hit, clicked on a link in a phishing email and accidentally downloaded a Remote Access Trojan. The attackers used the Trojan to conduct reconnaissance on the breached network and eventually to move laterally into the merchant's PoS environment where they deployed a RAM memory scraper for harvesting payment card data.

The modus operandi was similar in the second incident as well, but investigators have so far been unable to determine how the attackers got initial access to the merchant's network, Visa said. In the second incident, the targeted gas station merchant accepted both chip transactions and magnetic stripe payments for in-store payments and only magnetic stripe payments at the gas pumps. Visa's analysis shows the attackers specifically targeted the mag stripe data, the company said.

Visa's alert did not mention how the attackers gained initial access to the network of the hospitality company though in that case as well, the attackers targeted the PoS system.

Sophisticated Cybercrime Groups

Telemetry from both of the latter two incidents suggested that FIN8 was involved, Visa said.  The command and control server used in the attack on the second merchant and the file used to store stolen payment card data for instance, have both been previously linked to FIN8. Similarly, the malware that was used in the hospitality chain attack is also something that FIN8 has used in the past.

Visa's alert did not identify the cybercrime group behind the first attack. But in the past it has warned about a group called FIN6 compromising multiple PoS environments via a malware tool called Trinity POS or FrameworkPOS.

Card-stealing attacks against gas station chains in particular are increasing because many have yet to implement the EMV smartcard standard for payment transactions, Visa said. Chip cards offer significantly better protection against card data theft and cloning, compared to cards using magnetic stripes to store account and cardholder information.

Visa, MasterCard, American Express, and other card companies have for some time required all organizations accepting payment card transactions to cut over to EMV chip card technology. The migration has been happening in a phased manner across industry sectors for several years. Fuel merchants have until October 2020 to enable chip acceptance at fuel pumps. After that date, the liability for breaches will shift to the merchants that experience the breach.

Visa and the other major credit card associations have also recommended the use of point-to-point encryption, tokenization and other measures for protecting card data. Some of these measures are mandatory requirements under the Payment Card Industry Data Security Standard (PCI DSS).

Despite such measures, the US payment card infrastructure has lagged considerably behind other countries that have long ago moved to Chip and PIN technology.  The continued use of magnetic stripes has made the US payment environment an attractive target for criminals in recent years.

“EMV chips were created to make it expensive to manufacture counterfeit cards or steal money by tampering with a card or a transaction," says Craig Young security threat researcher at Tripwire.

Chip-and-PIN enabled cards provide stronger defenses against misuse when lost or stolen though neither implementation eliminates the RAM scraping threats described in the Visa alert, he says. "Elimination of magnetic stripes would force adversaries to adjust their tradecraft," but not completely eliminate the threat he says.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The Next Security Silicon Valley: Coming to a City Near You?"