LockPoS Malware Sneaks onto Kernel via new Injection Technique

Alarming evolution of Flokibot bypasses antivirus software and was likely built by a group of advanced attackers, researchers say.

A sneaky new injection technique delivers LockPoS malware straight into the kernel, researchers report. This silent method bypasses traditional antivirus software.
LockPoS is a type of point-of-sale (PoS) malware designed to snatch credit card data from the memory of computers connected to PoS card scanners. It reads the memory of processes running on the system to look for data that looks like payment card info and sends it to the command and control servers.
There are multiple stages of unpacking and decryption in LockPoS, but Cyberbit researchers report its most interesting traits are the injection technique and routines for code injection. The team discovered a new way LockPoS is arriving on machines.
LockPoS comes from the same botnet used to send Flokibot PoS, a bot based on leaked Zeus code
discovered
by Malwarebytes in 2016. The LockPoS injection technique is similar to the one used by Flokibot but uses different API calls for injection, and is more advanced overall.
Meir Brown, Cyberbits director of research for endpoint detection and response, says researchers detected the new technique when they discovered a LockPoS malware sample using remote access but couldnt identify the injection. Usually the technique is obvious.
It was somehow injected without us being able to see the injection technique, Brown explains, noting that malware typically uses a Windows API to operate code injection and there are many different APIs that malware can use. Here, there is no evidence of injection, he says.
Cyberbit malware analyst Hod Gavriel ran the malware through a reversing lab to understand this. He discovered the injection was silent because it directly entered the kernel. All the routines used to inject the code are exported from a core dll file of the Windows OS, which serves as a gate from the user space to the kernel space, researchers
report
. The malware avoids antivirus systems by mapping this core file from the disk to its own virtual address space.
Flokibot was not that impressive because the injection was still discoverable, says Gavriel. Here, in LockPoS, it is totally silent. It can inject code without raising any flags. Somebody put a lot of effort into this malware … its not simple code.
He calls this an alarming evolution of Flokibot that was likely built by a group of advanced attackers. This is not something that can be done by five people in a lab. This is an operation.
Brown says this discovery is a sign PoS malware is evolving. Authors are investing more in generating attacks on vendors and creating more advanced threats to both stay hidden and evade security tools. While it has been used in the wild, he notes researchers have not seen any evidence of specific breaches that used this LockPoS injection technique.
The whole point-of-sale, retail market should be aware theyre being targeted, he says. They need to raise the bar in security. This doesnt only mean investing in the right technology, but the right people. Businesses need someone to understand and respond to threats they detect.
Ed Cabrera, chief cybersecurity officer at Trend Micro, says researchers at the company are seeing a lot of innovation going on in PoS malware. While the bot delivery method has been around for a while, attackers are evolving their strategies around distributing malware.
Theyre not improving the malware itself but theyre improving the process for delivering, and becoming much more effective in their tactics, he explains. Attackers are refining their campaigns, using automation to launch attacks and exfiltrate information. Many are narrowing their focus on smaller businesses, which typically dont have strong security measures in place.
One trend were seeing is -- thanks to PoS malware bots that are conducting these types of attacks -- criminals can be much more effective in doing automated attacks, possibly reaching small and medium-sized businesses in a much more effective way, he explains.
Cabrera says retailers are becoming better at understanding the threats they face but usually dont ramp up their security strategies until after a breach, when their vulnerabilities are made much more obvious. Depending on the store, they start building security programs in response, he says.
Related Content:
Critical Microprocessor Flaws Affect Nearly Every Machine
Forever 21 Found Malware and Encryption Disabled on its PoS Devices
The Internet of (Secure) Things Checklist
Google Apps Script Vulnerability Exposes SaaS to URL-based Threats

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
LockPoS Malware Sneaks onto Kernel via new Injection Technique