This theft started from one of the Target’s vendors-Fazio Mechanical Services.The hackers had obtained the firm’s user code and password by sending a simple phishing email to which a Fazio employee responded and remotely penetrate Target’s network with this information in their possession and managed to access the company’s payment system network by exploiting vulnerabilities in the security measures in place which was linked to the point-of-sale terminal network.The hackers managed to penetrate it and to install malware called BlackPOS on the terminals capturing all the data stored on credit and debit cards that are swiped at the infected terminal.This process happened in the instant when the server processing the transaction has to store the raw data in its random access memory for a few milliseconds and the copied data were immediately saved on one of Target’s web servers which had been hacked.Those hackers took advantage of their remote access capability to retrieve a copy of the data amassed after testing and installation of the malware. During the network’s normal peak traffic periods ,these data were then copied on three servers outside of Target.
1. Intelligence Collection and detection: Cybercriminals will first conduct in-depth intelligence gathering on Target companies (such as Target). They may analyze a company’s network architecture, security protocols, and how data flows and is stored. Use public information, social media, security breach reports, and other channels to identify potential points of intrusion.
2. Tool development or procurement: Based on the results of intelligence gathering, the perpetrators will develop or purchase customized malware (such as trojans, ransomware, keyloggers, etc.). These tools can be used to steal data, compromise systems, or bypass security measures.
3. Initial intrusion: Perpetrators look for and exploit security vulnerabilities or weaknesses in a company’s network, such as unpatched software vulnerabilities, weak passwords, insecure remote access Settings, etc. Once successful, they may try to elevate permissions to gain deeper access to the system.
4. Internal reconnaissance and data targeting: Within the corporate network, criminals will detect and locate systems and databases containing valuable data (such as credit card information, customer data, etc.). They may use a variety of techniques and tools to hide their activities and avoid detection. 5. Data theft and transfer: Perpetrators steal targeted data and may encrypt or compress it to reduce the size of the transfer. They may use a variety of methods to secretly transfer data out of the target network, such as via encrypted channels, file sharing services, anonymous networks (such as Tor), etc.
6. Data exploitation and fencing: Stolen data can be used for a variety of illegal activities, such as credit card fraud, identity theft, extortion, etc. The perpetrators may sell the data on the underground market or share it with other criminal gangs for more profit.
7. Clearing traces and evading capture: After completing a theft, the perpetrator attempts to clean up any traces they have left on the targeted network in order to prevent detection. They may use a variety of techniques and tactics to confuse tracking, conceal identities, and evade law enforcement.
Please note that this is only a rough sequence of steps, and the way each criminal gang operates and the steps may be different. In addition, cybercrime is a constantly evolving and changing field, with new technologies and strategies constantly emerging, making these criminal activities more difficult to track and combat.
The hackers initially penetrated Target’s network between November 15 and 27 through a vulnerability exploited from one of its vendors, Fazio Mechanical Services. They were able to gain remote access to the network by using a simple phishing email technique where an employee from Fazio fell for the trap, handing over user credentials. Once inside the network, Cybercriminals break into target’s point-of-sale network and install malware called memory scrapers on terminals designed to capture all the data stored on credit and debit cards swiped on infected terminals, This malware, known as BlackPOS, was later found to be similar to software originating from Russia.
Penetration of Target’s Network: Between November 15 and 27, 2013, the hackers penetrated Target’s point-of-sale (POS) network by compromising the credentials of one of Target’s vendors, Fazio Mechanical Services, through a phishing email.
Installation of Malware: The hackers installed malware on Target’s POS terminals. The malware, resembling BlackPOS, was designed to capture unencrypted credit and debit card data at the moment of transaction when it was stored briefly in the POS terminal’s random access memory.
Testing and Deployment: Initial tests were conducted to ensure the malware functioned correctly. After successful testing, the malware was deployed across approximately 1,800 POS devices in Target stores.
1. Phishing Attack on Vendor:
The theft began when hackers sent a phishing email to Fazio Mechanical Services.
2. Network Penetration:
Using the obtained credentials, hackers remotely penetrated Target’s network. They accessed the company’s payment system network, exploiting security vulnerabilities.
3. Malware Installation:
The hackers installed malware called BlackPOS on Target’s POS terminals. This malware captured data from credit and debit cards swiped at the infected terminals.
4. Data Capture:
The malware copied card data during the transaction process, storing it momentarily in the server’s random access memory (RAM) before saving it on a hacked web server.
5. Data Retrieval:
Hackers used their remote access to retrieve the collected data daily. They amassed over 11 gigabytes of card data without detection.
6. External Data Storage:
The stolen data were copied to three external servers located in Miami, Brazil, and another U.S. location. These servers served as temporary storage.
7. Final Data Transfer:
Ultimately, the hackers transferred the stolen data to a server in Moscow. They then sold the data on the black market, completing the theft.
Penetration of Target’s Network: Between November 15 and 27, 2013, the hackers penetrated Target’s point-of-sale (POS) network by compromising the credentials of one of Target’s vendors, Fazio Mechanical Services, through a phishing email.
Installation of Malware: The hackers installed malware on Target’s POS terminals. The malware, resembling BlackPOS, was designed to capture unencrypted credit and debit card data at the moment of transaction when it was stored briefly in the POS terminal’s random access memory.
Testing and Deployment: Initial tests were conducted to ensure the malware functioned correctly. After successful testing, the malware was deployed across approximately 1,800 POS devices in Target stores.
First, cybercriminals accessed Target’s network by exploiting a vendor, Fazio Mechanical Services, using credentials obtained from a phishing attack.
Then, they installed BlackPOS-like malware on 1,800 POS terminals to capture credit and debit card data.
Next, the malware scraped unencrypted card data from the terminals’ memory, storing it on a hacked Target server.
Following this, the criminals remotely accessed the data during busy hours to avoid detection, transferring over 11 gigabytes of data to servers in Miami, Brazil, and the U.S.
Finally, the stolen data was moved to a Moscow server and sold on the black market, with card batches priced between $20 and $100.
1. Information gathering. Criminals first collect intelligence on the target company to understand the company’s business operations, IT structure, security strategy.
2. Use of malware. The criminals install malware on terminals that are actually computers at the time of purchase. The malware is designed to capture data stored on all credit and debit cards swiped at the infected terminal.
3. Leakage of data. The installation of the malware starts capturing data from all cards used at the target store during this period.
4. Evading security monitoring. Criminals remove any traces left by the malware, making it difficult to assess the full extent of the damage without an in-depth criminal investigation.
5. Data diversion. After storing the stolen data on these external servers for a period of time, the criminals eventually transferred them to a server in Moscow.
(1) Information reconnaissance: Criminals first conduct reconnaissance on the target to collect detailed information about its network structure, security settings, employee information, etc.
(2) Target selection: After collecting sufficient information, criminals will choose the most attractive target, which is usually based on the potential value of the target, the severity of security vulnerabilities, or the ease of penetration.
(3) Tool preparation: Criminals will prepare tools for attacks, which may include malware, phishing emails, viruses, worms, trojans, ransomware, etc.
(4) Preliminary penetration: Using collected information and prepared tools, criminals will attempt to break through the target’s security line and gain initial access to the network.
(5) Permission escalation: Once obtaining initial access, criminals will attempt to elevate their permissions on the network in order to access more sensitive data and systems.
(6) Data collection: After obtaining sufficient permissions, criminals will start collecting sensitive data from the target network, such as user credentials, credit card information, trade secrets, etc.
(7) Data leakage: Criminals may choose to leak data to public channels or sell it to third parties in order to obtain economic benefits.
(8) Covering up tracks: After completing theft activities and successfully obtaining data, criminals will attempt to delete or modify log files, turn off security alerts, and clear other potential evidence to cover up their movements.
(9) Evacuation: Finally, criminals will safely evacuate the target network to ensure that they are not tracked or arrested. They may use tools such as anonymous networks (such as Tor), encrypted communication, or VPN to hide their identity and location.
Firstly, cybercriminals obtained the user code and password of the company by sending a simple phishing email. With this information, cybercriminals can remotely infiltrate Target’s network and successfully access the company’s payment system network by exploiting vulnerabilities in existing security measures. Then, the hacker successfully infiltrated Target’s sales network and installed malicious software on the terminal, known as a memory crawler. It replicates data in the most vulnerable areas. In this case, the copied data is immediately saved on a network server of Target. Hackers obtained important information about Target through this method.
Cybercriminals usually follow a series of carefully planned steps when committing theft. Firstly, they will conduct intelligence gathering and obtain sensitive information about the target individual or company through social engineering, phishing, and other means, such as login credentials, account details, etc.
Next, criminals will use the collected information to attempt to infiltrate the target system. This usually involves exploiting vulnerabilities, weak passwords, or malicious software to break through the system’s security defenses. Once successfully invaded, they will further deploy malicious software in the system, such as keyloggers, data theft tools, etc., to continuously monitor and steal target data.
In the stage of data theft, criminals will carefully select valuable information, such as credit card information, bank account passwords, trade secrets, etc., for bulk downloading or transmission. Finally, in order to cover up the crime, they may clear system logs, modify configuration files, or deploy other obfuscation methods, making it difficult for victims to discover that data has been stolen for a period of time. Throughout the process, criminals usually maintain a low profile to avoid attracting attention and ensure that their actions are not stopped in a timely manner.
Here are the steps the cybercriminals followed in committing the theft.
Firstly,the cybercriminals obtained the HVAC firm Fazio Mechanical Services’ user code and password by sending a simple phishing email. It is one of its vendors who had remote access to Target’s network for the purposes of electronic billing, contract submission and project management.
With this information in their possession, the cybercriminals were able to remotely penetrate Target’s network and, by exploiting vulnerabilities in the security measures in place, managed to access the company’s payment system network, which was linked to the point-of-sale terminal network. This cleared the path for them to install their malware.
Secondly,Between November 15 and 27, the hackers managed to penetrate Target’s point-of-sale network (most cash registers today are actually computers) and to install malware on the terminals. This software is designed to be installed on point-of-sale terminals and to capture all the data stored on credit and debit cards that are swiped at the infected terminal. In this case,the copied data were immediately saved on one of Target’s web servers, which had been hacked.
Thirdly,between November 15 and 27, the cybercriminals ran tests to make sure everything was working properly. A few days later, they installed the malware on all of Target’s terminals (approximately 1,800 devices), which then began to make a copy of the numbers of all cards used.
Each day, in order to avoid drawing attention, the cybercriminals took advantage of their remote access capability to retrieve a copy of the data amassed (over 11 gigabytes), working between 10:00 a.m. and 6:00 p.m. during the network’s normal peak traffic periods. These data were then copied on three servers outside of Target, most likely without the knowledge of their owners; reportedly, there was one server in Miami, one in Brazil and another in the United States.
When cybercriminals commit theft, they usually:
1. Collect information about the target through the network or other means, such as email address, user name, password prompt question, etc. Use tools to scan target systems for vulnerabilities, open ports, and services.
2. Obtain the victim’s login credentials through forged emails or websites. Also exploited a software vulnerability in the target system to gain access.
3. Use the leaked user name and password to log in to the target system.
4. Install malware on the target system for easy access in the future.
5. Upgrade your own permissions to gain more control, even as a system administrator. Anonymous software is also used to delete or modify system log files to hide traces of intrusions.
In the Target data breach case, the cybercriminals took the following steps to steal: 1. From November 15 to 27, hackers managed to break into Target’s point-of-sale network and install malware on end devices. The malware is similar to a program called BlackPOS and is said to have originated in Russia. It is designed to be installed on a point-of-sale terminal and captures all credit and debit card data stored on the terminal when the card is swiped. 2. This malware is a memory grabber that copies the raw data the moment the transaction server stores it in random-access memory. In this case, the replicated data is immediately saved on one of the Web servers of the hacked Target. 3. This malware is difficult to detect by commonly used intrusion detection software because it usually removes any traces left behind, making it difficult to assess the scope of the damage without an in-depth criminal investigation. 4. Between 15 and 27 November, cybercriminals ran tests to make sure everything was ok. A few days later, they installed malware on all of Target’s end devices and started copying the card numbers of all the cards they used. 5. To avoid attracting attention, cybercriminals exploit the remote access feature, during the normal peak traffic of the network.
The cybercriminals obtained the user code and password of one of Target’s vendors, Fazio Mechanical Services, through a phishing email. With this information, they remotely penetrated Target’s network and accessed the company’s payment system network, which was linked to the point-of-sale terminal network. This allowed them to install the malware on the terminals. Despite Target’s multiple layers of protection and investment in cybersecurity, the cybercriminals were able to bypass these measures. Target had implemented an advanced monitoring system called FireEye, but the alerts issued by the system were ignored.
Overall, the cybercriminals followed a systematic process of penetrating Target’s network, installing malware on the terminals, copying the stolen data, and transferring it to external servers.
(1) Cyber-criminals first gather targeted information by installing malware on point-of-sale terminals that allows them to capture payment card data when swiping a card on an infected terminal. They then use hacking tools or techniques to break into targeted systems.
(2) The malware copies the card’s data and saves it on an infected web server in the target company’s network, and the cyber-criminals retrieve the stolen data remotely in bulk during peak traffic hours to avoid detection.
(3) They further collate this data so that they can extract account information that can be hacked. Although the criminals in this case had not yet committed the actual theft, they were prepared for the possibility of financial fraud.
(4) The stolen data was temporarily stored on servers in Miami, Brazil, as well as on servers in the United States, before being transferred to servers in Moscow. The data is then sold on the black market, where the cards are divided into 1 million, with prices ranging from $20 to $100 per card.
In summary, they exploited vendor access, installed memory-scraping malware, captured and steal card data over weeks, and then sold the stolen data on underground markets specializing in financial crimes.
First, they used phishing emails to obtain user codes and passwords for an HVAC company that works with Target, and then used those credentials to remotely break into Target’s network. After the breach, the criminals installed “BlackPOS” malware on Target’s point-of-sale (POS) terminals. The software was designed to capture credit and debit card data at the POS, including card numbers, expiration dates and card verification codes.
The criminals then extracted the data during peak hours each day and transmitted it to servers in multiple locations. Through this process, they obtained information on approximately a large number of credit and debit cards.
In the Target data breach case, cybercriminals took the following steps to commit theft:
1.From November 15 to 27, hackers successfully penetrated Target’s point-of-sale network and installed malware on terminal devices. The malware is similar to a program called BlackPOS, which is installed on point-of-sale terminals and grabs all credit and debit card data stored on the terminals when the cards are swiped.
2. This malware is a memory grabber that copies the raw, unencrypted data at the exact moment the trading server stores it in memory. In this case, the copied data is immediately saved on one of the hacked Target’s Web servers.
3. This malware is difficult to detect with frequently used intrusion detection software because it usually erases any traces left behind, making it difficult to assess the scope of the damage without an in-depth criminal investigation.
4. Between November 15 and 27, the cybercriminals conducted tests to make sure everything worked. A few days later, they installed malware on all of Target’s terminal devices and began copying the card numbers of all the cards used.
5. To avoid attracting attention, cybercriminals use remote access capabilities to retrieve copies of accumulated data during the network’s normal peak traffic period (10 a.m. to 6 p.m.). The data was then copied to three servers outside of Target, without the knowledge of the server owners.
1.Cybercriminals first obtained the company’s user code and password by sending phishing emails to a supplier of Target, Fazio Mechanical Services. Once they succeed, they use this information to remotely invade Target’s network.
2.They used the loopholes in security measures to access the company’s payment system network, which is connected with the point-of-sale terminal network. This enables them to install malicious software. Between November 15 and 27, they conducted tests to ensure that everything was running normally.
3.They installed malware on all the terminals of Target (about 1800 devices), and these devices began to copy the numbers of all the used cards. In order not to attract attention, hackers use the remote access function to extract the data accumulated the day before (more than 11GB) from 10 am to 6 pm every day during the peak network traffic, and copy the data to three servers other than Target.
The cybercriminals followed a strategy involving the installation of malware on Target’s point-of-sale terminals, capturing sensitive card data during transactions. They gained unauthorized access by exploiting vulnerabilities in the vendor’s remote access system, obtained through a phishing email. Despite Target’s robust cybersecurity measures, their alerts weren’t adequately assessed, allowing the attack to proceed. The stolen data was ultimately transferred to a server in Moscow, implicating a group of cybercriminals in Russia and Ukraine.
The criminal installed malicious software on Target’s POS terminal. This malware is similar to BlackPOS and aims to capture unencrypted credit and debit card data during transactions, and temporarily store it in the random access memory of the POS terminal. Then preliminary testing was conducted to ensure that the malware was running properly. After successful testing, the copied data is immediately saved on a network server of Target that has been hacked. During the normal peak traffic period of the network, this data is replicated to three servers outside of Target.
The cybercriminals executed the Target data breach through the following steps:
1. Compromising Point-of-Sale Network: Hackers infiltrated Target’s Point-of-Sale (POS) network by installing malware on terminals.
2. Deploying BlackPOS Malware: They used BlackPOS malware, a memory scraper, to capture credit and debit card data from transactions at infected terminals.
3. Data Exfiltration: The malware copied card data and saved it on a compromised Target web server.
4. Remote Data Retrieval: Cybercriminals remotely accessed and retrieved over 11GB of data during peak traffic periods.
5. Temporary Server Storage: Stolen data were stored on temporary servers in Miami, Brazil, and the U.S., unbeknownst to the server owners.
6. Data Transfer to Moscow: The data were then transferred to a server in Moscow, highlighting the international scope of the operation.
In summary, hackers installed malware on endpoints, conducted man-in-the-middle attacks to intercept data, used proxy servers to evade detection, and ultimately delivered the data to their servers.
First, hackers successfully penetrated Target’s point-of-sale network and installed malware on terminal devices. The malware is similar to a program called BlackPOS and is said to have originated in Russia. It is designed to be installed on point-of-sale terminals and capture all credit and debit card data stored on the terminals when the card is swiped. Then,The malware is a memory grabber that copies the original data at the moment the trading server stores it in random access memory. In this case, the copied data is immediately saved on one of the hacked Target’s Web servers. Next,This malware is difficult to detect by commonly used intrusion detection software because it usually removes any traces left behind, making it difficult to assess the scope of the damage without an in-depth criminal investigation. Besidea, Between November 15 and 27, cybercriminals conducted tests to make sure everything was working. A few days later, they installed malware on all of Target’s terminal devices and began copying the card numbers of all the cards they used. Lastly, To avoid attracting attention, cybercriminals exploit remote access features during the network’s normal peak traffic. During normal network peak traffic. During normal network peak traffic.
Hackers will infiltrate Target’s sales outlets(most cash registers today are actually computers) and to install malware on the terminals. The malware resembled a widely known program called BlackPOS, which purportedly originated in Russia. Available for about $2,000 on the black market, this software is designed to be installed on point-of-sale terminals and to capture all the data stored on credit and debit cards that are swiped at the infected terminal. This type of malicious software, known as a memory scraper, makes a copy of the data at the point where they are the most vulnerable – that is, in the instant when the server processing the transaction has to store the raw data (unencrypted) in its random access memory for a few milliseconds. In this case, the copied data were immediately saved on one of Target’s web servers, which had been hacked. This type of malware is particularly dangerous because it is difficult for the generally used intrusion detection software to detect it.the cybercriminals ran tests to make sure everything was working properly. A few days later, they installed the malware on all of Target’s terminals(approximately 1,800 devices), which then began to make a copy of the numbers of all cards used. Each day, in order to avoid drawing attention, the cybercriminals took advantage of their remote access capability to retrieve a copy of the data amassed (over 11 gigabytes), working between 10:00 a.m. and 6:00 p.m. during the network’s normal peak traffic periods. These data were then copied on three servers outside of Target, most likely without the knowledge of their owners; reportedly, there was one server in Miami, one in Brazil and another in the United States.’The investigation apparently uncovered a copy of the data carelessly dumped on one of these servers that had been used as temporary storage.
Through the analysis and feedback of the Target data breach, we can summarize the steps and intentions of cyber criminals to steal.
Before the main operation begins, the criminal needs to anticipate the target of infiltration:
1. Investigate the target information, including the network structure and l, security policies and staff conditions.
2. Based on the information collected in step 1, target the most cost-effective target.
3. Attack preparation tools, the most typical representatives are malicious software and error code emails.
Having completed the above preparations, the criminal makes the initial move:
1. Through the previous preparation, break through the primary security line of the target and obtain the initial access to the target network.
2. Install a malware program similar to BlackPOS on the terminal device, which can capture the card data stored on the terminal when the user swipes the card.
3. Conduct preliminary tests to ensure that the malware works properly. After a successful test, the copied data is automatically saved on the intrusion server.
4. Finally, the data was copied to three servers outside of Target and leaked to third parties for profit.
Start the evacuation process after the theft:
1. Remove potential evidence and cover up the theft process.
2. Hide their identity and location through anonymous networks, encrypted communications and VPNS.
1. Intelligence gathering: The perpetrator first collects critical information about the target company, such as business operations, IT architecture, and security policies.
2. Obtain login credentials: Hackers successfully obtained employee credentials of Target suppliers through phishing emails.
3. Cyber intrusion: Using the obtained credentials, hackers gained access to Target’s network and breached the payment system.
4. Malware implantation: Malware is installed at point-of-sale terminals to capture credit and debit card data.
5. Data theft: During transaction processing, hackers steal and store sensitive data.
6. Remote data extraction: Hackers remotely extract copies of stored data.
7. Data transfer: The stolen data is transferred to an external server.
8. Elimination of traces: The perpetrator removes traces of the operation to avoid detection.
Cybercriminals follow the following specific steps when stealing
1. Infiltrate the target company’s network，Cybercriminals successfully penetrate the target company’s network system by exploiting vulnerabilities in the target company’s network or social engineering.2. Install malware， Once successful, cybercriminals install malware on their terminal devices, such as BlackPOS, to steal data from credit and debit cards.3. Data collection，The malware copies and stores the unencrypted raw data in memory on the transaction processing server.4. Transfer data，Cybercriminals transfer stolen data from the target company’s servers to other servers, usually on foreign servers, to avoid detection.5. Sales data，The stolen data will eventually be sold on the black market for other criminals who can use it to go on for fraudulent activities, such as buying goods or cloning credit cards.
1. Collect key information about the target company, such as business operations, IT architecture, and security policies.
2. Obtain employee credentials: Successfully obtain supplier credentials through phishing emails.
3. Network intrusion: Use obtained credentials to access the target company’s network and invade the payment system.
4. Install malware: Install malware such as BlackPOS on sales terminal devices to steal credit and debit card data.
5. Data theft: Stealing and storing sensitive data during transaction processing.
6. Remote data extraction: Hackers remotely extract stored data.
7. Data transmission: Transfer stolen data to external servers.
8. Eliminating traces: Eliminating operational traces to avoid detection.
From November 15 to 27, Target’s network was hacked. bender’s fazio system uses a simple phishing technique to connect to a remote network and send a certificate to the user. If the fact that x is smaller than -2 is connected to the network, the cybercriminals will break into the target network, set up a malicious program called “capture memory”, and take all the data of the infected credit card and the direct fulcrum of the terminal, leaving the psi part of x unallocated
Criminals begin by conducting in-depth intelligence gathering, analyzing the target company’s network architecture, security protocols, and how data flows and is stored. Then, based on the intelligence gathering results, custom malware such as trojans, ransomware, keyloggers, etc. are developed or purchased to steal data, compromise systems, or bypass security measures. Criminals look for and exploit security vulnerabilities or weaknesses in the target company’s network, such as unpatched software vulnerabilities, weak passwords, insecure remote access Settings, etc. Once successful, they may attempt to upgrade permissions to gain deeper access to the system. In internal networks, criminals detect and locate systems and databases that contain valuable data, such as credit card information, customer data, and more. They may use a variety of techniques and tools to hide their activities and avoid detection. The criminals then steal the targeted data, possibly encrypt or compress it to reduce the transmission size, and use various methods to secretly transfer the data out of the target network, such as encrypted channels, file sharing services, anonymous networks, and so on. Stolen data can be used for a variety of illegal activities, such as credit card fraud, identity theft, extortion, and more. Criminals may sell the data on underground markets or share it with other criminal gangs for more profit. Finally, criminals try to erase any traces left on the targeted network to avoid detection. They may use a variety of techniques and tactics to obfuscate tracking, conceal identities, and evade law enforcement. This is only a rough sequence of steps, and each criminal gang’s operations and steps may differ. In addition, cybercrime is a constantly evolving and changing field, with new technologies and strategies constantly emerging to make these criminal activities more difficult to track and combat.
Firstly, cybercriminals have targeted one of Target’s suppliers, Fazio Mechanical Services, a Pennsylvania based HVAC company, which can remotely access Target’s network for electronic billing, contract submission, and project management. Cybercriminals obtain the company’s user code and password by sending a simple phishing email, remotely infiltrate Target’s network, and exploit vulnerabilities in existing security measures to access the company’s payment system network, which is connected to the sales point terminal network.
Then from November 15th to 27th, hackers managed to infiltrate Target’s point of sale network (most cash registers are actually computers) and install malicious software on terminals, capturing all data stored on credit and debit cards swiped by infected terminals, and saving the replicated data on Target’s web server, which has been hacked by hackers.
Finally, these hackers utilize their remote access capabilities to retrieve copies of data accumulated after testing and installing malicious software. During normal peak hours on the network, this data is replicated to three servers outside of Target.
Hackers will infiltrate Target’s sales outlets(most cash registers today are actually computers) and to install malware on the terminals. The malware resembled a widely known program called BlackPOS, which purportedly originated in Russia. Available for about $2,000 on the black market, this software is designed to be installed on point-of-sale terminals and to capture all the data stored on credit and debit cards that are swiped at the infected terminal. This type of malicious software, known as a memory scraper, makes a copy of the data at the point where they are the most vulnerable – that is, in the instant when the server processing the transaction has to store the raw data (unencrypted) in its random access memory for a few milliseconds. In this case, the copied data were immediately saved on one of Target’s web servers, which had been hacked. This type of malware is particularly dangerous because it is difficult for the generally used intrusion detection software to detect it.the cybercriminals ran tests to make sure everything was working properly. A few days later, they installed the malware on all of Target’s terminals(approximately 1,800 devices), which then began to make a copy of the numbers of all cards used. Each day, in order to avoid drawing attention, the cybercriminals took advantage of their remote access capability to retrieve a copy of the data amassed (over 11 gigabytes), working between 10:00 a.m. and 6:00 p.m. during the network’s normal peak traffic periods. These data were then copied on three servers outside of Target, most likely without the knowledge of their owners; reportedly, there was one server in Miami, one in Brazil and another in the United States.’The investigation apparently uncovered a copy of the data carelessly dumped on one of these servers that had been used as temporary storage
This theft started from one of the Target’s vendors-Fazio Mechanical Services.The hackers had obtained the firm’s user code and password by sending a simple phishing email to which a Fazio employee responded and remotely penetrate Target’s network with this information in their possession and managed to access the company’s payment system network by exploiting vulnerabilities in the security measures in place which was linked to the point-of-sale terminal network.The hackers managed to penetrate it and to install malware called BlackPOS on the terminals capturing all the data stored on credit and debit cards that are swiped at the infected terminal.This process happened in the instant when the server processing the transaction has to store the raw data in its random access memory for a few milliseconds and the copied data were immediately saved on one of Target’s web servers which had been hacked.Those hackers took advantage of their remote access capability to retrieve a copy of the data amassed after testing and installation of the malware. During the network’s normal peak traffic periods ,these data were then copied on three servers outside of Target.
1. Intelligence Collection and detection: Cybercriminals will first conduct in-depth intelligence gathering on Target companies (such as Target). They may analyze a company’s network architecture, security protocols, and how data flows and is stored. Use public information, social media, security breach reports, and other channels to identify potential points of intrusion.
2. Tool development or procurement: Based on the results of intelligence gathering, the perpetrators will develop or purchase customized malware (such as trojans, ransomware, keyloggers, etc.). These tools can be used to steal data, compromise systems, or bypass security measures.
3. Initial intrusion: Perpetrators look for and exploit security vulnerabilities or weaknesses in a company’s network, such as unpatched software vulnerabilities, weak passwords, insecure remote access Settings, etc. Once successful, they may try to elevate permissions to gain deeper access to the system.
4. Internal reconnaissance and data targeting: Within the corporate network, criminals will detect and locate systems and databases containing valuable data (such as credit card information, customer data, etc.). They may use a variety of techniques and tools to hide their activities and avoid detection. 5. Data theft and transfer: Perpetrators steal targeted data and may encrypt or compress it to reduce the size of the transfer. They may use a variety of methods to secretly transfer data out of the target network, such as via encrypted channels, file sharing services, anonymous networks (such as Tor), etc.
6. Data exploitation and fencing: Stolen data can be used for a variety of illegal activities, such as credit card fraud, identity theft, extortion, etc. The perpetrators may sell the data on the underground market or share it with other criminal gangs for more profit.
7. Clearing traces and evading capture: After completing a theft, the perpetrator attempts to clean up any traces they have left on the targeted network in order to prevent detection. They may use a variety of techniques and tactics to confuse tracking, conceal identities, and evade law enforcement.
Please note that this is only a rough sequence of steps, and the way each criminal gang operates and the steps may be different. In addition, cybercrime is a constantly evolving and changing field, with new technologies and strategies constantly emerging, making these criminal activities more difficult to track and combat.
The hackers initially penetrated Target’s network between November 15 and 27 through a vulnerability exploited from one of its vendors, Fazio Mechanical Services. They were able to gain remote access to the network by using a simple phishing email technique where an employee from Fazio fell for the trap, handing over user credentials. Once inside the network, Cybercriminals break into target’s point-of-sale network and install malware called memory scrapers on terminals designed to capture all the data stored on credit and debit cards swiped on infected terminals, This malware, known as BlackPOS, was later found to be similar to software originating from Russia.
Penetration of Target’s Network: Between November 15 and 27, 2013, the hackers penetrated Target’s point-of-sale (POS) network by compromising the credentials of one of Target’s vendors, Fazio Mechanical Services, through a phishing email.
Installation of Malware: The hackers installed malware on Target’s POS terminals. The malware, resembling BlackPOS, was designed to capture unencrypted credit and debit card data at the moment of transaction when it was stored briefly in the POS terminal’s random access memory.
Testing and Deployment: Initial tests were conducted to ensure the malware functioned correctly. After successful testing, the malware was deployed across approximately 1,800 POS devices in Target stores.
1. Phishing Attack on Vendor:
The theft began when hackers sent a phishing email to Fazio Mechanical Services.
2. Network Penetration:
Using the obtained credentials, hackers remotely penetrated Target’s network. They accessed the company’s payment system network, exploiting security vulnerabilities.
3. Malware Installation:
The hackers installed malware called BlackPOS on Target’s POS terminals. This malware captured data from credit and debit cards swiped at the infected terminals.
4. Data Capture:
The malware copied card data during the transaction process, storing it momentarily in the server’s random access memory (RAM) before saving it on a hacked web server.
5. Data Retrieval:
Hackers used their remote access to retrieve the collected data daily. They amassed over 11 gigabytes of card data without detection.
6. External Data Storage:
The stolen data were copied to three external servers located in Miami, Brazil, and another U.S. location. These servers served as temporary storage.
7. Final Data Transfer:
Ultimately, the hackers transferred the stolen data to a server in Moscow. They then sold the data on the black market, completing the theft.
Penetration of Target’s Network: Between November 15 and 27, 2013, the hackers penetrated Target’s point-of-sale (POS) network by compromising the credentials of one of Target’s vendors, Fazio Mechanical Services, through a phishing email.
Installation of Malware: The hackers installed malware on Target’s POS terminals. The malware, resembling BlackPOS, was designed to capture unencrypted credit and debit card data at the moment of transaction when it was stored briefly in the POS terminal’s random access memory.
Testing and Deployment: Initial tests were conducted to ensure the malware functioned correctly. After successful testing, the malware was deployed across approximately 1,800 POS devices in Target stores.
First, cybercriminals accessed Target’s network by exploiting a vendor, Fazio Mechanical Services, using credentials obtained from a phishing attack.
Then, they installed BlackPOS-like malware on 1,800 POS terminals to capture credit and debit card data.
Next, the malware scraped unencrypted card data from the terminals’ memory, storing it on a hacked Target server.
Following this, the criminals remotely accessed the data during busy hours to avoid detection, transferring over 11 gigabytes of data to servers in Miami, Brazil, and the U.S.
Finally, the stolen data was moved to a Moscow server and sold on the black market, with card batches priced between $20 and $100.
1. Information gathering. Criminals first collect intelligence on the target company to understand the company’s business operations, IT structure, security strategy.
2. Use of malware. The criminals install malware on terminals that are actually computers at the time of purchase. The malware is designed to capture data stored on all credit and debit cards swiped at the infected terminal.
3. Leakage of data. The installation of the malware starts capturing data from all cards used at the target store during this period.
4. Evading security monitoring. Criminals remove any traces left by the malware, making it difficult to assess the full extent of the damage without an in-depth criminal investigation.
5. Data diversion. After storing the stolen data on these external servers for a period of time, the criminals eventually transferred them to a server in Moscow.
(1) Information reconnaissance: Criminals first conduct reconnaissance on the target to collect detailed information about its network structure, security settings, employee information, etc.
(2) Target selection: After collecting sufficient information, criminals will choose the most attractive target, which is usually based on the potential value of the target, the severity of security vulnerabilities, or the ease of penetration.
(3) Tool preparation: Criminals will prepare tools for attacks, which may include malware, phishing emails, viruses, worms, trojans, ransomware, etc.
(4) Preliminary penetration: Using collected information and prepared tools, criminals will attempt to break through the target’s security line and gain initial access to the network.
(5) Permission escalation: Once obtaining initial access, criminals will attempt to elevate their permissions on the network in order to access more sensitive data and systems.
(6) Data collection: After obtaining sufficient permissions, criminals will start collecting sensitive data from the target network, such as user credentials, credit card information, trade secrets, etc.
(7) Data leakage: Criminals may choose to leak data to public channels or sell it to third parties in order to obtain economic benefits.
(8) Covering up tracks: After completing theft activities and successfully obtaining data, criminals will attempt to delete or modify log files, turn off security alerts, and clear other potential evidence to cover up their movements.
(9) Evacuation: Finally, criminals will safely evacuate the target network to ensure that they are not tracked or arrested. They may use tools such as anonymous networks (such as Tor), encrypted communication, or VPN to hide their identity and location.
Firstly, cybercriminals obtained the user code and password of the company by sending a simple phishing email. With this information, cybercriminals can remotely infiltrate Target’s network and successfully access the company’s payment system network by exploiting vulnerabilities in existing security measures. Then, the hacker successfully infiltrated Target’s sales network and installed malicious software on the terminal, known as a memory crawler. It replicates data in the most vulnerable areas. In this case, the copied data is immediately saved on a network server of Target. Hackers obtained important information about Target through this method.
Cybercriminals usually follow a series of carefully planned steps when committing theft. Firstly, they will conduct intelligence gathering and obtain sensitive information about the target individual or company through social engineering, phishing, and other means, such as login credentials, account details, etc.
Next, criminals will use the collected information to attempt to infiltrate the target system. This usually involves exploiting vulnerabilities, weak passwords, or malicious software to break through the system’s security defenses. Once successfully invaded, they will further deploy malicious software in the system, such as keyloggers, data theft tools, etc., to continuously monitor and steal target data.
In the stage of data theft, criminals will carefully select valuable information, such as credit card information, bank account passwords, trade secrets, etc., for bulk downloading or transmission. Finally, in order to cover up the crime, they may clear system logs, modify configuration files, or deploy other obfuscation methods, making it difficult for victims to discover that data has been stolen for a period of time. Throughout the process, criminals usually maintain a low profile to avoid attracting attention and ensure that their actions are not stopped in a timely manner.
Here are the steps the cybercriminals followed in committing the theft.
Firstly,the cybercriminals obtained the HVAC firm Fazio Mechanical Services’ user code and password by sending a simple phishing email. It is one of its vendors who had remote access to Target’s network for the purposes of electronic billing, contract submission and project management.
With this information in their possession, the cybercriminals were able to remotely penetrate Target’s network and, by exploiting vulnerabilities in the security measures in place, managed to access the company’s payment system network, which was linked to the point-of-sale terminal network. This cleared the path for them to install their malware.
Secondly,Between November 15 and 27, the hackers managed to penetrate Target’s point-of-sale network (most cash registers today are actually computers) and to install malware on the terminals. This software is designed to be installed on point-of-sale terminals and to capture all the data stored on credit and debit cards that are swiped at the infected terminal. In this case,the copied data were immediately saved on one of Target’s web servers, which had been hacked.
Thirdly,between November 15 and 27, the cybercriminals ran tests to make sure everything was working properly. A few days later, they installed the malware on all of Target’s terminals (approximately 1,800 devices), which then began to make a copy of the numbers of all cards used.
Each day, in order to avoid drawing attention, the cybercriminals took advantage of their remote access capability to retrieve a copy of the data amassed (over 11 gigabytes), working between 10:00 a.m. and 6:00 p.m. during the network’s normal peak traffic periods. These data were then copied on three servers outside of Target, most likely without the knowledge of their owners; reportedly, there was one server in Miami, one in Brazil and another in the United States.
When cybercriminals commit theft, they usually:
1. Collect information about the target through the network or other means, such as email address, user name, password prompt question, etc. Use tools to scan target systems for vulnerabilities, open ports, and services.
2. Obtain the victim’s login credentials through forged emails or websites. Also exploited a software vulnerability in the target system to gain access.
3. Use the leaked user name and password to log in to the target system.
4. Install malware on the target system for easy access in the future.
5. Upgrade your own permissions to gain more control, even as a system administrator. Anonymous software is also used to delete or modify system log files to hide traces of intrusions.
In the Target data breach case, the cybercriminals took the following steps to steal: 1. From November 15 to 27, hackers managed to break into Target’s point-of-sale network and install malware on end devices. The malware is similar to a program called BlackPOS and is said to have originated in Russia. It is designed to be installed on a point-of-sale terminal and captures all credit and debit card data stored on the terminal when the card is swiped. 2. This malware is a memory grabber that copies the raw data the moment the transaction server stores it in random-access memory. In this case, the replicated data is immediately saved on one of the Web servers of the hacked Target. 3. This malware is difficult to detect by commonly used intrusion detection software because it usually removes any traces left behind, making it difficult to assess the scope of the damage without an in-depth criminal investigation. 4. Between 15 and 27 November, cybercriminals ran tests to make sure everything was ok. A few days later, they installed malware on all of Target’s end devices and started copying the card numbers of all the cards they used. 5. To avoid attracting attention, cybercriminals exploit the remote access feature, during the normal peak traffic of the network.
The cybercriminals obtained the user code and password of one of Target’s vendors, Fazio Mechanical Services, through a phishing email. With this information, they remotely penetrated Target’s network and accessed the company’s payment system network, which was linked to the point-of-sale terminal network. This allowed them to install the malware on the terminals. Despite Target’s multiple layers of protection and investment in cybersecurity, the cybercriminals were able to bypass these measures. Target had implemented an advanced monitoring system called FireEye, but the alerts issued by the system were ignored.
Overall, the cybercriminals followed a systematic process of penetrating Target’s network, installing malware on the terminals, copying the stolen data, and transferring it to external servers.
(1) Cyber-criminals first gather targeted information by installing malware on point-of-sale terminals that allows them to capture payment card data when swiping a card on an infected terminal. They then use hacking tools or techniques to break into targeted systems.
(2) The malware copies the card’s data and saves it on an infected web server in the target company’s network, and the cyber-criminals retrieve the stolen data remotely in bulk during peak traffic hours to avoid detection.
(3) They further collate this data so that they can extract account information that can be hacked. Although the criminals in this case had not yet committed the actual theft, they were prepared for the possibility of financial fraud.
(4) The stolen data was temporarily stored on servers in Miami, Brazil, as well as on servers in the United States, before being transferred to servers in Moscow. The data is then sold on the black market, where the cards are divided into 1 million, with prices ranging from $20 to $100 per card.
In summary, they exploited vendor access, installed memory-scraping malware, captured and steal card data over weeks, and then sold the stolen data on underground markets specializing in financial crimes.
First, they used phishing emails to obtain user codes and passwords for an HVAC company that works with Target, and then used those credentials to remotely break into Target’s network. After the breach, the criminals installed “BlackPOS” malware on Target’s point-of-sale (POS) terminals. The software was designed to capture credit and debit card data at the POS, including card numbers, expiration dates and card verification codes.
The criminals then extracted the data during peak hours each day and transmitted it to servers in multiple locations. Through this process, they obtained information on approximately a large number of credit and debit cards.
In the Target data breach case, cybercriminals took the following steps to commit theft:
1.From November 15 to 27, hackers successfully penetrated Target’s point-of-sale network and installed malware on terminal devices. The malware is similar to a program called BlackPOS, which is installed on point-of-sale terminals and grabs all credit and debit card data stored on the terminals when the cards are swiped.
2. This malware is a memory grabber that copies the raw, unencrypted data at the exact moment the trading server stores it in memory. In this case, the copied data is immediately saved on one of the hacked Target’s Web servers.
3. This malware is difficult to detect with frequently used intrusion detection software because it usually erases any traces left behind, making it difficult to assess the scope of the damage without an in-depth criminal investigation.
4. Between November 15 and 27, the cybercriminals conducted tests to make sure everything worked. A few days later, they installed malware on all of Target’s terminal devices and began copying the card numbers of all the cards used.
5. To avoid attracting attention, cybercriminals use remote access capabilities to retrieve copies of accumulated data during the network’s normal peak traffic period (10 a.m. to 6 p.m.). The data was then copied to three servers outside of Target, without the knowledge of the server owners.
1.Cybercriminals first obtained the company’s user code and password by sending phishing emails to a supplier of Target, Fazio Mechanical Services. Once they succeed, they use this information to remotely invade Target’s network.
2.They used the loopholes in security measures to access the company’s payment system network, which is connected with the point-of-sale terminal network. This enables them to install malicious software. Between November 15 and 27, they conducted tests to ensure that everything was running normally.
3.They installed malware on all the terminals of Target (about 1800 devices), and these devices began to copy the numbers of all the used cards. In order not to attract attention, hackers use the remote access function to extract the data accumulated the day before (more than 11GB) from 10 am to 6 pm every day during the peak network traffic, and copy the data to three servers other than Target.
The cybercriminals followed a strategy involving the installation of malware on Target’s point-of-sale terminals, capturing sensitive card data during transactions. They gained unauthorized access by exploiting vulnerabilities in the vendor’s remote access system, obtained through a phishing email. Despite Target’s robust cybersecurity measures, their alerts weren’t adequately assessed, allowing the attack to proceed. The stolen data was ultimately transferred to a server in Moscow, implicating a group of cybercriminals in Russia and Ukraine.
The criminal installed malicious software on Target’s POS terminal. This malware is similar to BlackPOS and aims to capture unencrypted credit and debit card data during transactions, and temporarily store it in the random access memory of the POS terminal. Then preliminary testing was conducted to ensure that the malware was running properly. After successful testing, the copied data is immediately saved on a network server of Target that has been hacked. During the normal peak traffic period of the network, this data is replicated to three servers outside of Target.
The cybercriminals executed the Target data breach through the following steps:
1. Compromising Point-of-Sale Network: Hackers infiltrated Target’s Point-of-Sale (POS) network by installing malware on terminals.
2. Deploying BlackPOS Malware: They used BlackPOS malware, a memory scraper, to capture credit and debit card data from transactions at infected terminals.
3. Data Exfiltration: The malware copied card data and saved it on a compromised Target web server.
4. Remote Data Retrieval: Cybercriminals remotely accessed and retrieved over 11GB of data during peak traffic periods.
5. Temporary Server Storage: Stolen data were stored on temporary servers in Miami, Brazil, and the U.S., unbeknownst to the server owners.
6. Data Transfer to Moscow: The data were then transferred to a server in Moscow, highlighting the international scope of the operation.
In summary, hackers installed malware on endpoints, conducted man-in-the-middle attacks to intercept data, used proxy servers to evade detection, and ultimately delivered the data to their servers.
First, hackers successfully penetrated Target’s point-of-sale network and installed malware on terminal devices. The malware is similar to a program called BlackPOS and is said to have originated in Russia. It is designed to be installed on point-of-sale terminals and capture all credit and debit card data stored on the terminals when the card is swiped. Then,The malware is a memory grabber that copies the original data at the moment the trading server stores it in random access memory. In this case, the copied data is immediately saved on one of the hacked Target’s Web servers. Next,This malware is difficult to detect by commonly used intrusion detection software because it usually removes any traces left behind, making it difficult to assess the scope of the damage without an in-depth criminal investigation. Besidea, Between November 15 and 27, cybercriminals conducted tests to make sure everything was working. A few days later, they installed malware on all of Target’s terminal devices and began copying the card numbers of all the cards they used. Lastly, To avoid attracting attention, cybercriminals exploit remote access features during the network’s normal peak traffic. During normal network peak traffic. During normal network peak traffic.
Hackers will infiltrate Target’s sales outlets(most cash registers today are actually computers) and to install malware on the terminals. The malware resembled a widely known program called BlackPOS, which purportedly originated in Russia. Available for about $2,000 on the black market, this software is designed to be installed on point-of-sale terminals and to capture all the data stored on credit and debit cards that are swiped at the infected terminal. This type of malicious software, known as a memory scraper, makes a copy of the data at the point where they are the most vulnerable – that is, in the instant when the server processing the transaction has to store the raw data (unencrypted) in its random access memory for a few milliseconds. In this case, the copied data were immediately saved on one of Target’s web servers, which had been hacked. This type of malware is particularly dangerous because it is difficult for the generally used intrusion detection software to detect it.the cybercriminals ran tests to make sure everything was working properly. A few days later, they installed the malware on all of Target’s terminals(approximately 1,800 devices), which then began to make a copy of the numbers of all cards used. Each day, in order to avoid drawing attention, the cybercriminals took advantage of their remote access capability to retrieve a copy of the data amassed (over 11 gigabytes), working between 10:00 a.m. and 6:00 p.m. during the network’s normal peak traffic periods. These data were then copied on three servers outside of Target, most likely without the knowledge of their owners; reportedly, there was one server in Miami, one in Brazil and another in the United States.’The investigation apparently uncovered a copy of the data carelessly dumped on one of these servers that had been used as temporary storage.
Through the analysis and feedback of the Target data breach, we can summarize the steps and intentions of cyber criminals to steal.
Before the main operation begins, the criminal needs to anticipate the target of infiltration:
1. Investigate the target information, including the network structure and l, security policies and staff conditions.
2. Based on the information collected in step 1, target the most cost-effective target.
3. Attack preparation tools, the most typical representatives are malicious software and error code emails.
Having completed the above preparations, the criminal makes the initial move:
1. Through the previous preparation, break through the primary security line of the target and obtain the initial access to the target network.
2. Install a malware program similar to BlackPOS on the terminal device, which can capture the card data stored on the terminal when the user swipes the card.
3. Conduct preliminary tests to ensure that the malware works properly. After a successful test, the copied data is automatically saved on the intrusion server.
4. Finally, the data was copied to three servers outside of Target and leaked to third parties for profit.
Start the evacuation process after the theft:
1. Remove potential evidence and cover up the theft process.
2. Hide their identity and location through anonymous networks, encrypted communications and VPNS.
1. Intelligence gathering: The perpetrator first collects critical information about the target company, such as business operations, IT architecture, and security policies.
2. Obtain login credentials: Hackers successfully obtained employee credentials of Target suppliers through phishing emails.
3. Cyber intrusion: Using the obtained credentials, hackers gained access to Target’s network and breached the payment system.
4. Malware implantation: Malware is installed at point-of-sale terminals to capture credit and debit card data.
5. Data theft: During transaction processing, hackers steal and store sensitive data.
6. Remote data extraction: Hackers remotely extract copies of stored data.
7. Data transfer: The stolen data is transferred to an external server.
8. Elimination of traces: The perpetrator removes traces of the operation to avoid detection.
Cybercriminals follow the following specific steps when stealing
1. Infiltrate the target company’s network，Cybercriminals successfully penetrate the target company’s network system by exploiting vulnerabilities in the target company’s network or social engineering.2. Install malware， Once successful, cybercriminals install malware on their terminal devices, such as BlackPOS, to steal data from credit and debit cards.3. Data collection，The malware copies and stores the unencrypted raw data in memory on the transaction processing server.4. Transfer data，Cybercriminals transfer stolen data from the target company’s servers to other servers, usually on foreign servers, to avoid detection.5. Sales data，The stolen data will eventually be sold on the black market for other criminals who can use it to go on for fraudulent activities, such as buying goods or cloning credit cards.
1. Collect key information about the target company, such as business operations, IT architecture, and security policies.
2. Obtain employee credentials: Successfully obtain supplier credentials through phishing emails.
3. Network intrusion: Use obtained credentials to access the target company’s network and invade the payment system.
4. Install malware: Install malware such as BlackPOS on sales terminal devices to steal credit and debit card data.
5. Data theft: Stealing and storing sensitive data during transaction processing.
6. Remote data extraction: Hackers remotely extract stored data.
7. Data transmission: Transfer stolen data to external servers.
8. Eliminating traces: Eliminating operational traces to avoid detection.
From November 15 to 27, Target’s network was hacked. bender’s fazio system uses a simple phishing technique to connect to a remote network and send a certificate to the user. If the fact that x is smaller than -2 is connected to the network, the cybercriminals will break into the target network, set up a malicious program called “capture memory”, and take all the data of the infected credit card and the direct fulcrum of the terminal, leaving the psi part of x unallocated
Criminals begin by conducting in-depth intelligence gathering, analyzing the target company’s network architecture, security protocols, and how data flows and is stored. Then, based on the intelligence gathering results, custom malware such as trojans, ransomware, keyloggers, etc. are developed or purchased to steal data, compromise systems, or bypass security measures. Criminals look for and exploit security vulnerabilities or weaknesses in the target company’s network, such as unpatched software vulnerabilities, weak passwords, insecure remote access Settings, etc. Once successful, they may attempt to upgrade permissions to gain deeper access to the system. In internal networks, criminals detect and locate systems and databases that contain valuable data, such as credit card information, customer data, and more. They may use a variety of techniques and tools to hide their activities and avoid detection. The criminals then steal the targeted data, possibly encrypt or compress it to reduce the transmission size, and use various methods to secretly transfer the data out of the target network, such as encrypted channels, file sharing services, anonymous networks, and so on. Stolen data can be used for a variety of illegal activities, such as credit card fraud, identity theft, extortion, and more. Criminals may sell the data on underground markets or share it with other criminal gangs for more profit. Finally, criminals try to erase any traces left on the targeted network to avoid detection. They may use a variety of techniques and tactics to obfuscate tracking, conceal identities, and evade law enforcement. This is only a rough sequence of steps, and each criminal gang’s operations and steps may differ. In addition, cybercrime is a constantly evolving and changing field, with new technologies and strategies constantly emerging to make these criminal activities more difficult to track and combat.
Firstly, cybercriminals have targeted one of Target’s suppliers, Fazio Mechanical Services, a Pennsylvania based HVAC company, which can remotely access Target’s network for electronic billing, contract submission, and project management. Cybercriminals obtain the company’s user code and password by sending a simple phishing email, remotely infiltrate Target’s network, and exploit vulnerabilities in existing security measures to access the company’s payment system network, which is connected to the sales point terminal network.
Then from November 15th to 27th, hackers managed to infiltrate Target’s point of sale network (most cash registers are actually computers) and install malicious software on terminals, capturing all data stored on credit and debit cards swiped by infected terminals, and saving the replicated data on Target’s web server, which has been hacked by hackers.
Finally, these hackers utilize their remote access capabilities to retrieve copies of data accumulated after testing and installing malicious software. During normal peak hours on the network, this data is replicated to three servers outside of Target.
Hackers will infiltrate Target’s sales outlets(most cash registers today are actually computers) and to install malware on the terminals. The malware resembled a widely known program called BlackPOS, which purportedly originated in Russia. Available for about $2,000 on the black market, this software is designed to be installed on point-of-sale terminals and to capture all the data stored on credit and debit cards that are swiped at the infected terminal. This type of malicious software, known as a memory scraper, makes a copy of the data at the point where they are the most vulnerable – that is, in the instant when the server processing the transaction has to store the raw data (unencrypted) in its random access memory for a few milliseconds. In this case, the copied data were immediately saved on one of Target’s web servers, which had been hacked. This type of malware is particularly dangerous because it is difficult for the generally used intrusion detection software to detect it.the cybercriminals ran tests to make sure everything was working properly. A few days later, they installed the malware on all of Target’s terminals(approximately 1,800 devices), which then began to make a copy of the numbers of all cards used. Each day, in order to avoid drawing attention, the cybercriminals took advantage of their remote access capability to retrieve a copy of the data amassed (over 11 gigabytes), working between 10:00 a.m. and 6:00 p.m. during the network’s normal peak traffic periods. These data were then copied on three servers outside of Target, most likely without the knowledge of their owners; reportedly, there was one server in Miami, one in Brazil and another in the United States.’The investigation apparently uncovered a copy of the data carelessly dumped on one of these servers that had been used as temporary storage