Author of TreasureHunter PoS Malware Releases Its Source Code

Leak gives threat actors a way to build newer, nastier versions of the point-of-sale malware, Flashpoint says.

In a development that could spell trouble for point-of-sale (PoS) operators, the author of TreasureHunter, a point-of-sale malware family that has been circulating in the wild since at least 2014, has released source code for the malware.
Along with it, the threat actor has also released code for TreasureHunters graphical user interface builder and the malwares administrator panel, security vendor Flashpoint said in an advisory this week.
The code release, in a leading Russian underground forum, has given security researchers fresh insight into the malware, which they have had to reverse engineer up to this point in order to analyze.
Vitali Kremez, director of research at Flashpoint, says the code has provided some unique insight into the coders mindset and operational style. Flashpoint, in collaboration with security researchers from Cisco Talos, has already been able to use the leaked code to improve protections around the malware and to be able to quickly disrupt potential copycat versions of it.
At the same time, the open availability of TreasureHunter code in a popular underground forum lowers the bar for other threat actors to build new and potentially more sophisticated versions of the PoS malware, Kremez says.
Based on our intelligence, this malware was linked to quite a few breaches [perpetrated by] Russian-speaking criminal groups targeting small-sized and medium-sized retailers, Kremez says. But the full source code was up to now reserved for BearsInc, a notorious Russian-speaking group that specializes in selling stolen card data via low-tier and midtier hacking and carding communities.
Flashpoint says its researchers have already observed Russian-speaking threat actors discussing ways to improve and weaponize TreasureHunter in new ways. How exactly malware authors will use the code to improve TreasureHunter remains unclear. Likely, cybercriminals would work on improving [the malwares] communication protocol and adding more functionality to it, Kremez says.
The leaked code shows that the original author planned to tweak various features of the malware, including its anti-debugging capabilities and communication logic. The code also contains a long list of to-do items and suggestions for improving the overall functionality of TreasureHunter.
What is not clear at the moment is why exactly the Russian-speaking author of the malware decided to leak its source code publicly. We hypothesize it is likely they did this in [an] attempt to distance themselves from being unique malware code owners, says Kremez. Often, threat actors resort to the tactic to frustrate efforts by law enforcement investigators and security researchers to attribute attacks and malware to specific threat actors and groups.
For instance, in September 2016, the three authors of Mirai — one of whom was a former Rutgers University student — decided to publicly release its source code after infecting hundreds of thousands of Internet of Things devices worldwide with the malware.
Prosecutors described
the leak as an attempt by the trio to cover their tracks and to build plausible deniability of their direct connection to the malware.
Threat actors later took advantage of the leaked Mirai code to build multiple versions of the malware, including one that was responsible for disrupting services at DNS provider Dyn and numerous other major Internet companies.
A similar leak of the Zeus banking Trojan code back in 2011 resulted in multiple more-dangerous versions of the malware becoming available soon after. PoS malware leaks have had similar effects, most notably with the 2015 leak of the Alina malware, which led to the creation of the ProPoS and Katrina variants, Kremez wrote in the
Flashpoint blog post
announcing the code leak this week.
Related Content:
IoT DDoS Attack Code Released
Trial Begins for Latvian Man Accused of Malware Operation
Apple iOS iBoot Secure Bootloader Code Leaked Online
9 Banking Trojans & Trends Costing Businesses in 2017

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Author of TreasureHunter PoS Malware Releases Its Source Code