A hacking group that specializes in infecting online stores to steal credit card data is responsible for the breach of about 700 websites. The gang, called UltraRank, has been active since at least 2015 and uses web skimmers and malicious JavaScript,known as JS sniffers.
The gang sells credit‑card information through a subsidiary card store, earning tens of thousands of dollars weekly.
UltraRank changed tactics
Security researchers at Group-IB say that the UltraRank group changed tactics and infrastructure several times over the years, making it difficult to identify, as they didn't know which operations and campaigns to associate it with.
In a technical report released this week, researchers provide evidence that UltraRank is the group behind the incidents attributed to the Magecart.
In three long‑term campaigns that were launched in 2015, 2016 and 2018, the gang managed to «plant» JS‑sniffers on 691 individual websites with very high traffic, such as ticket‑resale sites for sporting events.
However, this number is conservative considering the group breached 13 ISPs. The 13 ISPs are likely used by thousands of websites around the world.
Among those victims are French advertising agency Adverline and The Brandit Agency, a marketing firm that creates websites using the Magento platform .
Indicators
The group's three campaigns, named by Group-IB, FakeLogistics, WebRank, and SnifLite, were based on JS sniffers. They also shared some common capabilities and infrastructure that allowed the detection of malicious activity when the group's first attacks occurred:
- similar methods for hiding the location and the patterns for domain registration
- storing the same malicious code in multiple locations with different domain names
- targeted attacks
The starting point of the investigation was the host “toplevelstatic[.] Com” which hosted a JS sniffer to compromise The Brandit Agency. The same domain stored files used in attacks against other online stores.
Group-IB is almost certain that the UltraRank team handles these three functions, but researchers believe it may also be involved in other campaigns.
