Group with Numerous Faces: Chronicle of UltraRank's Deceptive JS-Sniffer Campaigns

News provided by

Aug 27, 2020, 08:32 ET

SINGAPORE, Aug. 27, 2020 /PRNewswire/ -- Group-IB, a global threat hunting and intelligence company headquartered in Singapore, today released its report "UltraRank: the unexpected twist of a JS sniffer triple threat." In its paper, Group-IB provides evidence linking 3 campaigns with the use of various JavaScript-sniffer families, previously attributed by cybersecurity researchers to various Magecart groups, to the same hacker group. This group was dubbed UltraRank by Group-IB.

UltraRank combined attacks on single targets with supply chain attacks, in just 5 years, the group compromised nearly 700 websites and 13 third-party suppliers (advertising and browser notification services, web design agencies, marketing agencies) in Europe, Asia, North and Latin Americas and designed its own model to monetize the stolen data of bank cards – through the cardshop ValidCC.

Cybercrime prodigy
In less than 18 months, the number of JS sniffer families more than doubled: today, Group-IB analysts see at least 96 families, while in March 2019, when Group-IB released its first research into this threat, the figure stood at 38. The underground forums monitoring, thorough analysis of existing JS sniffer samples, and the search for new website infections enabled Group-IB to take on a new stage of research, i.e. to attribute attacks involving JS sniffers.

In February 2020, Group-IB experts discovered that the US marketing company The Brandit Agency, which created websites for its clients running CMS Magento, was compromised. As a result, at least five websites created by the marketing agency were infected with JS-sniffers.

The abovementioned attack served as a starting point of Group-IB's research, which resulted in the discovery of the attackers' infrastructure that turned out to be linked to earlier attacks involving JS sniffers, attributed by researchers to different groups, namely Group 2, Group 5 and Group 12. What was perceived as separate episodes, turned out to be three campaigns conducted by UltraRank.

In all campaigns similar mechanisms to hide the threat actors' server location and domain registration patterns were used. In addition, several storage locations for malicious code with identical contents were discovered. What distinguishes the three operations is the choice of JS-sniffer — FakeLogistics, WebRank, and SnifLite.

Winning strategy
Unlike other JS sniffer operators that monetize the stolen bank card data by purchasing posh goods and then reselling them or cooperate with third-party carders, UltraRank created its own scheme for monetizing stolen bank card data by selling it through an affiliated cardshop — ValidCC, whose infrastructure is linked to UltraRank's one. According to the cardshop's internal statistics, its average income from the sale of bank card data was $5,000 to $7,000 per day, in a single week in 2019. Another $25,000-$30,000 was paid by ValidCC to third-party suppliers of stolen payment data.

The store's official representative on underground forums is a user with the nickname SPR. In many posts, SPR claims that the card data sold in the ValidCC store was obtained using JS sniffers. Most of SPR's posts are written in English, however, SPR often switches to Russian.

Another fact suggesting that UltraRank is not an ordinary player of the cybercriminal market are the competition methods used by the group: Group-IB experts tracked UltraRank's hacks of websites already compromised by rival cybercriminal groups and DDoS attacks on phishing pages masqueraded as ValidCC.

"The cybercriminal market is offering better quality of service, fine-tuning and simplifying the instruments for solving specific tasks," comments Group-IB Threat Intelligence analyst Victor Okorokov. "In the coming years, we will definitely see the growth in the use of this malicious instrument since many online shops and service providers still neglect their cybersecurity, using outdated CMSs that have vulnerabilities."

Contact:
Group-IB PR Team
+65 3159-3798
[email protected]

SOURCE Group-IB