3 Indonesian hackers were arrested by Interpol in a coordinated government operation for hacking hundreds of website E-commerce using the JS-Sniffer Malware.
The ANF (27), K (35) and N (23) who were residing in Indonesia and ran the malicious campaign targeting E-Commerce websites with the malware known as JavaScript-sniffer.
JavaScript-sniffer is specifically used in attacks on E-Commerce websites to steal customers' payment card details and personal data, such as names, addresses and phone, by sending the information to Command and Control (C2) servers controlled by cybercriminals.
JavaScript-sniffer was first detected in 2018, used by the unknown cybercriminal group to infect Magento websites, and there was evidence collected by Group-IB that showed that the attackers were using malware and attempted to infect online merchants who would in turn infect their websites with JS-sniffer.
During this time, nearly 200 websites in Indonesia, Australia, Europe, the United States, South America, and some other countries have been infected.
These malware exploitation entities that infected E-commerce websites from Indonesia were arrested with the help of the Indonesian government police and five other ASEAN countries that shared intelligence data with Interpol.
The Cybersecurity Group-IB consortium of companies from Singapore supported this research with its expertise in medical forensics, helping to locate the suspects.
All three hackers were arrested in December from various parts of Indonesia, and Indonesian cyber police seized laptops, mobile phones of various brands, CPU, ID cards, BCA Token cards, ATM cards during the investigation.
According to the criminal code of Indonesia, hackers are charged with theft of electronic data, which carries a prison sentence of 10 years.
Craig Jones, Interpol's Director of Cybercrime, said that "strong and effective partnerships between police and the cyber industry are essential to ensuring that law enforcement around the world has access to the information they need to deal with the scale and complexity of today's cyber landscape."
The research reveals that the malware originates from the GetBilling family and is used by these Indonesian hackers to steal various sensitive information and use it to purchase goods such as electronic devices or other luxury items and resell them in the Indonesian market at a lower price.
The number of compromised cards that were uploaded to dark forums increased from 27.1 million in 2018 to 43.8 million in 2019.
GBHackers has learned that authorities have seized the Command and control servers that these criminals to collect data from victims.
