[biot]

The article also says:

  "RAM scrapers, by contrast, can be installed remotely on a Big Box
   retailer’s network and deployed widely to dozens of stores in a
   franchise, without an attacker ever leaving his computer. They can
   also be deleted remotely to erase crucial evidence of the crime."

The ability to remotely install and delete RAM scrapers from anywhere in the world precludes this being a hardware device.