Rdasrv is a POS malware that targets Windows-based payment terminals by using RAM scraping techniques to capture payment card data from system memory during transactions. It searches for Track 1 and Track 2 card information before encryption and stores the stolen data locally for later retrieval. Rdasrv is associated with early point-of-sale malware campaigns and primarily focuses on memory-based card data collection rather than automated data exfiltration.
POS systems can be exposed to malware through compromised endpoints, phishing, weak credentials, vulnerable software, or insecure remote-access tools. Because payment data may briefly exist in readable form in system memory, traditional encryption alone may not prevent RAM-scraping attacks. Organisations can reduce the risk by restricting POS terminal access, applying network segmentation, securing remote administration, monitoring endpoint activity, maintaining software updates, and using hardware-level security and real-time threat detection.
Point of Sale (POS) Attack is a technique utilized by cybercriminals to obtain credit card and debit card information at the point of sale and payment terminals, using POS malware. The attackers apply man in the middle attack to intercept data processing at the retail checkout point of sale system. For instance, they employ RAM scrapping approach that involves accessing the memory of the system and exporting data through Remote Access Trojan (RAT). This technique is accompanied by minimum software and hardware tampering thus difficult to detect. Among the POS malware variants utilized by the attackers to scrape the RAM include Rdasrv, Alina, VSkimmer, Decter, BlackPOS, FastPOS, PunkeyPOS, Multigrain Malware, CenterPOS, and MalumPOS.
How Rdasrv Infects the System
Rdasrv installs itself into a windows computer as an executable file named rdasrv.exe. The POS malware scans through credit card data extracting confidential credit card information including the name, account number, expiry date, and other information that the attackers intend to steal. After scraping the information, the malware stores into a file named data.txt or current block.txt and transmits it to the hacker.
X-PHY Protection Method
The POS cyber criminals utilize a number of weaknesses in the system terminals to launch an attack. For instance, the POS targeted POS malware gets into the system when employees use the terminals for internet browsing or receive emails. Additionally, the need for regular remote access to the terminals for central updates and troubleshooting also provides a surface for the malware to attack the system. X-PHY AI Embedded Cyber Secure SSD offers the most advanced protection with the cyber security solution comprising of X-Guard Threat Lock, X-Stream Protection, X-Factor Encryption Lock, and X-Site secure to ensure that confidential data in the POS system is secure.
X-PHY AI Embedded Cyber Secure SSD offers the most advanced protection with the cyber security solution comprising of real-time security monitoring. All the incoming and outgoing data streams are monitored to ensure that a threat is detected before it causes any harm. In this case, a POS malware will be detected as soon as it is downloaded into the system. As such, the malware will be stopped before it compromises the integrity of the credit information in the system.
When the malware gets into the system, it resides at the retailer endpoints where it scans POS terminal memory for card data to send to the botmaster. When a transaction is recorded, the associated data is instantly stored on the retailer endpoints. Even though the system is designed to encrypt the data immediately, the POS malware utilizes a tiny window where the data remains unencrypted as it awaits authorization and be saved in process memory.
The Firmware Digital Signature solution in X-PHY AI Embedded Cyber Secure SSD enables digital signature in the firmware to verify the authenticity and integrity of the stored data. As such, the malware residing at the retailer endpoints will fail the test and be identified before it causes harm. Early identification would trigger system lockdown protocol that would protect the data from malicious attackers.
Also, businesses in high-risk industries can benefit from specialized solutions like financial sector cybersecurity and healthcare cybersecurity, which protect critical payment and patient information from similar endpoint malware threats.
For high-value, regulated environments, secure government operations and energy sector cybersecurity provide robust endpoint and data protection against sophisticated malware such as Rdasrv.
Organizations adopting zero-trust security frameworks and ransomware protection strategies can further reduce attack surface and contain threats before exfiltration or system compromise occurs.
