Malware
malware:kameo
Point-of-sale malware described as capturing keystrokes and payment-card data and sending it to a server in Russia.
Point-of-sale malware described as capturing keystrokes and payment-card data and sending it to a server in Russia.
“they both had malware running on them called Kameo with a K”
“The malware would listen for keystrokes made and look for credit cards being swiped”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | AFFECTS | Windows 8 | Derived | 32 |
| incoming | USES | Roman Seleznev | Uncertain | 32 |
| incoming | INVOLVES | Schlotzsky’s Deli compromise | Explicit | 32 |
| incoming | INVOLVES | Broadway Grill compromise | Explicit | 32 |
Roman Seleznev USES Kameo
The episode says Roman installed Kameo on exposed Windows computers to scrape payment-card data, although the episode also frames the attribution as presumptive in places.
Uncertain Confidence 90% · Jack Rhysider EP 32 Details
“he’d install malware on it to scrape the cards off it and then send it to his server”
“presumably by Roman Seleznev”
Schlotzsky’s Deli compromise INVOLVES Kameo
The Schlotzsky's Deli compromise involved Kameo malware running on the registers.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“He found they both had malware running on them called Kameo with a K.”
Broadway Grill compromise INVOLVES Kameo
The Broadway Grill compromise involved a slightly different version of Kameo malware.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“These computers had the same Kameo malware that the detective found on the Schlotzsky’s Deli computers.”
Kameo infected Windows computers, including the Windows systems used by the affected businesses; the transcript does not specifically say Kameo ran on Windows 8.
Derived Confidence 72% · Jack Rhysider EP 32 Details
“they’re just regular Windows computers running the cash register software”