{"id":43623,"date":"2021-10-27T09:41:22","date_gmt":"2021-10-27T09:41:22","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/warehouse-belonging-to-chinese-payment-terminal-manufacturer-raided-by-fbi\/"},"modified":"2021-10-27T09:41:22","modified_gmt":"2021-10-27T09:41:22","slug":"warehouse-belonging-to-chinese-payment-terminal-manufacturer-raided-by-fbi","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/warehouse-belonging-to-chinese-payment-terminal-manufacturer-raided-by-fbi\/","title":{"rendered":"Warehouse belonging to Chinese payment terminal manufacturer raided by FBI"},"content":{"rendered":"

US feds were spotted raiding a warehouse belonging to Chinese payment terminal manufacturer PAX Technology in Jacksonville, Florida, on Tuesday, with speculation abounding that the machines contained preinstalled malware.<\/p>\n

PAX Technology is headquartered in Shenzhen, China, and is one of the largest electronic payment providers in the world. It operates around 60 million point-of-sale (PoS) payment terminals<\/a> in more than 120 countries.<\/p>\n

Local Jacksonville news anchor Courtney Cole tweeted photos of the scene.<\/p>\n

\n

This is a look at the investigation FBI investigation from our @ActionNewsJax<\/a> Sky Vision Drone. There are several agencies involved in this investigation @ PAX Technology Warehouse. \u2b07\ufe0f We\u2019ve seen FBI, Homeland Security + JSO here to assist. pic.twitter.com\/ZY24YfDI52<\/a><\/p>\n

\u2014 Courtney Cole (@CourtneyANJax) October 26, 2021<\/a><\/p><\/blockquote>\n

Local news outlet WOKV was able to obtain a statement from the Federal Bureau of Investigation (FBI) confirming<\/a> they were executing a court-authorised search as part of a federal investigation. The FBI said the investigation was active and ongoing but did not provide a timeline.<\/p>\n

Security buff Brian Krebs reported<\/a> that the raid could be tied to cyberattacks on the US and EU, tipped off by a major US payment processor who noticed the technology displaying suspicious behaviour. Allegedly the machines were giving off unusual network packets whose sizes didn’t match the data they should be sending and telemetry didn’t correlate to software updates.<\/p>\n

The PAX terminals were allegedly being used as malware droppers and command-and-control locations for staging attacks and collecting information. According to Krebs, a major financial provider in the US and in EU has already started pulling the machines and it’s not just the FBI investigating \u2013 MI5 is looking into the matter too.<\/p>\n

With PoS machines everywhere, it’s easy to overlook that the machines are computers with points of vulnerability. However, use of the technology as a malware carrier has been going on for a long time, and is rather inevitable given the items’ wide geographical distribution and access to credit cards.<\/p>\n