{"id":1264,"date":"2021-03-12T12:09:23","date_gmt":"2021-03-12T06:39:23","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=1264"},"modified":"2021-06-07T11:01:36","modified_gmt":"2021-06-07T05:31:36","slug":"fin8-hackers-using-more-updated-version-of-badhatch-pos-malware","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/","title":{"rendered":"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware!"},"content":{"rendered":"\n<p><p style=\"text-align: justify\">Attackers who are executing low profile attacks are now using a more updated version of the malware and ceasing the operations for long periods while catching the attention and re-updating their skills to overlaps the radar detection technologies.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">A group named FIN8 is now activated and also motivated the other attackers to start executing the banking frauds with the help of a powerful version of backdoor that has upgraded capabilities that also deal with screen capturing, credential theft, proxy tunneling, and other files execution.<\/p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How <\/strong><strong>T<\/strong><strong>his <\/strong><strong>A<\/strong><strong>ll <\/strong><strong>O<\/strong><strong>riginated?<\/strong><\/h2>\n\n\n\n<p><p style=\"text-align: justify\">The group was first identified by FireEye in 2016 and this is well known for retail, entertainment, hospitality, and another type of spear-phishing attacks that used the updated tools like PUNCHTRACK and BADHATCH while stealing the payment card data from the point-of-sale (POS) system.<\/p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"728\" height=\"478\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/fin8-hackers-return-with-power-image.jpg\" alt=\"FIN8 Hackers Using More Updated Version of BADHATCH Pos Malware!\" class=\"wp-image-1265\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/fin8-hackers-return-with-power-image.jpg 728w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/fin8-hackers-return-with-power-image-300x197.jpg 300w\" sizes=\"(max-width: 728px) 100vw, 728px\" \/><\/figure><\/div>\n\n\n\n<p><p style=\"text-align: justify\">The captured group is also taking long breaks while updating their protocols and enhance the rate of success. The security researcher also said that the BADHATCH malware is more updated and it is a powerful backdoor that occupies several evasion and other defense techniques. This newly updated backdoor also tries to bypass the security monitor with the help of TLS encryption to conceal PowerShell commands.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">The backdoor named BADHATCH was founded in 2019 and used as a running attacker that delivers commands that come from the server, while adding the malware to the system or injecting the malicious content to DLLs are also in process. The backdoor is also capable while gathering the system information and exfiltrating data to the server.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">However, from April 2020 three different versions of backdoor started from v2.12 to 2.14 are founded. The experts said that the BADHATCH is the latest version of this backdoor that exfiltrate the legitimate services known as sslp.io. It is athwart detection process that occurs during the deployment process and downloads the PowerShell script which executed the code the holds the BADHATCH DLL.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">Whereas the PowerShell script is also responsible for executing the persistence that takes care of all the privileges escalation that helps to ensure all the commands post and the script execution that runs on the SYSTEM user.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">After that, another version of the evasion technique is also adopted by FIN8 the deals with passing off the communications and command-and-control (C2) server that also trapped the HTTP requests.<\/p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Summering Up<\/strong><\/h2>\n\n\n\n<p><p style=\"text-align: justify\">Multiple experts also think that this new type of backdoor attack is replacing the old and slow attacks that happened last year. This time the hackers are more focused on insurance, retail, chemical industries, and technologies and targeted the people who are located in United States, South Africa, Italy, Canada, Puerto Rice, and Panama.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">Unlike other attacks that were done by cyber attackers, the FIN8 group is constantly updating its tools and methods to avoid unwanted detection. The group is also trying to separate the POS network from the one-time users and also filter out the other emails that contain malicious attachments for further attacks.<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attackers who are executing low profile attacks are now using a more updated version of the malware and ceasing the operations for long periods while catching the attention and re-updating their skills to overlaps the radar detection technologies. A group named FIN8 is now activated and also motivated the other attackers to start executing the [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1276,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.11 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>FIN8 Hackers Using More Updated Version of BADHATCH POS Malware! - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware! - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"Attackers who are executing low profile attacks are now using a more updated version of the malware and ceasing the operations for long periods while catching the attention and re-updating their skills to overlaps the radar detection technologies. A group named FIN8 is now activated and also motivated the other attackers to start executing the [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-03-12T06:39:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-06-07T05:31:36+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/fin8-hackers-return-with-power-featured-image-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"728\" \/>\n\t<meta property=\"og:image:height\" content=\"380\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware!\",\"datePublished\":\"2021-03-12T06:39:23+00:00\",\"dateModified\":\"2021-06-07T05:31:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/\"},\"wordCount\":499,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Breaches\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/\",\"url\":\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/\",\"name\":\"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware! - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-03-12T06:39:23+00:00\",\"dateModified\":\"2021-06-07T05:31:36+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware!\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware! - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/","og_locale":"en_US","og_type":"article","og_title":"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware! - Xiarch Solutions Private Limited","og_description":"Attackers who are executing low profile attacks are now using a more updated version of the malware and ceasing the operations for long periods while catching the attention and re-updating their skills to overlaps the radar detection technologies. A group named FIN8 is now activated and also motivated the other attackers to start executing the [&hellip;]","og_url":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-03-12T06:39:23+00:00","article_modified_time":"2021-06-07T05:31:36+00:00","og_image":[{"width":728,"height":380,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/fin8-hackers-return-with-power-featured-image-1.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware!","datePublished":"2021-03-12T06:39:23+00:00","dateModified":"2021-06-07T05:31:36+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/"},"wordCount":499,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Breaches"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/","url":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/","name":"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware! - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-03-12T06:39:23+00:00","dateModified":"2021-06-07T05:31:36+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/fin8-hackers-using-more-updated-version-of-badhatch-pos-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"FIN8 Hackers Using More Updated Version of BADHATCH POS Malware!"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/1264"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=1264"}],"version-history":[{"count":2,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/1264\/revisions"}],"predecessor-version":[{"id":1268,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/1264\/revisions\/1268"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/1276"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=1264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=1264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=1264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}