Trusted Design

New POS Malware Emerges - Punkey

概要

During a recent United States Secret Service investigation, Trustwave encountered a new family of POS malware, that we named Punkey. It appears to have evolved from the NewPOSthings family of malware first discovered by Dennis Schwarz and Dave Loftus at Arbor Networks. While this malware shares some commonalities with that family, it departs from the standard operating procedure of the previous versions rather dramatically. In a blog post, TrendMicro also detailed recently compiled versions of the NewPOSthings family that bear a closer resemblance to NewPOSthings than Punkey. This suggests that multiple actors may be using similar source code, or the malware is being customized as a service for targeted campaigns. Because of the active investigation, I cannot reveal C&C domains used in the samples.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - 6c7a26ac738c940cdce1e0fcbd9995994ce19332ea444c4ea87de52d2fe9713b -
• FileHash-SHA256 - 5ce1e0f1883d13561f9a1cef321db13c4fefddf4fed1d40e7e31f3b04595f527 -
• FileHash-SHA256 - 0a33332d200e52875c00ea98417b71621b77a9dc291e6a3bdbd69569aac670cf -
• FileHash-SHA256 - 04678de7a93ca1fd7fc7eba1672ec04c9855160b4cace440cfcd3c66d8543026 -
• FileHash-SHA256 - e06f57b984d52153d28bdf9e2629feb16e2dbdea617702fb3397c959ee70ed68 -
• FileHash-SHA256 - e0c4696093c71a8bbcd2aef357afca6c7b7fbfe787406f6797636a67ae9b975d -
• FileHash-SHA256 - 1dd9e1e661070c0d90faeef75d5a487641a4bfb99c58841827ee5b97e6315eaf -

類似Pulses

• Two New PoS Malware Affecting US SMBs (score: 0.66)
• Lazarus group: Operation Blockbuster (score: 0.65)
• BernhardPOS - New POS Malware (score: 0.63)
• NitlovePOS: Another New POS Malware (score: 0.63)
• New Targeted Attack Group Buys BIFROSE Code, Works in Teams (score: 0.63)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る