Even if anti-malware tools did not detect Backoff, companies should have still been able to spot malicious activity from it. For example, the companies should have spotted the massive transfers of stolen data taking place from within their networks, Schouwenberg said.
"Why does a POS terminal in Alabama need to connect to a server based in Russia?'' he asked. "There's just a whole number of things to show defenses are not up to par."
Sign up for CIO Asia eNewsletters.