Group with numerous faces: chronicle of UltraRank’s deceptive JS-sniffer campaigns

Group-IB security researchers provide evidence linking three campaigns with the use of various JS-sniffer families.

Singapore – Group-IB, a global threat hunting and intelligence company headquartered in Singapore, today released its analytical report “UltraRank: the unexpected twist of a JS-sniffer triple threat.” In its report, Group-IB Threat Intelligence experts provide evidence linking three campaigns with the use of various JavaScript-sniffer families – an instrument used by cybercriminals to steal text bank card data – previously attributed by cybersecurity researchers to various Magecart groups, to the same hacker group. This group was dubbed UltraRank by Group-IB.

In the context of UltraRank, the report exemplifies the JS-sniffers’ transformation from a minor online threat into a complex one supported by organized cybercrime. In just five years, the group compromised nearly 700 websites and 13 third-party suppliers in Europe, Asia, North and Latin Americas and designed its own model to monetize the stolen text data of bank cards – through the card shop ValidCC, whose revenue exceeded $5,000 perday.  

Cybercrime prodigy

In less than a year and a half, the number of JS-sniffer families more than doubled: today, Group-IB Threat Intelligence analysts see at least 96 JS-sniffer families, while in March 2019, when Group-IB released its first research into this threat, the figure stood at 38. The continuous monitoring of underground forums and card shops, thorough analysis of the maximum possible number of existing JS-sniffer samples, as well as the search for new website infections enabled Group-IB experts to take on a new stage of research, i.e. to attribute attacks involving JS-sniffers to a particular group. 

In February 2020, Group-IB Threat Intelligence experts discovered that the US marketing company The Brandit Agency, which created project websites for its clients running content management system (CMS) Magento, was compromised. As a result, at least five websites created by the marketing agency for its clients were infected with JS-sniffers. The malware was downloaded from the host toplevelstatic[.]com. This very website was used to load the malicious script on the website of the largest manufacturer and distributor of cash handling products in North America, Block & Company.

First clue

The abovementioned attacks served as a starting point of Group-IB’s research, which resulted in the discovery of the attackers’ infrastructure that turned out to be linked to several earlier attacks involving JS-sniffers. The company’s proprietary analytics systems and a unique array of data (including samples), enabled Group-IB experts to establish connections between these incidents and already known attacks, attributed by cybersecurity researchers to three different groups, namely Group 2, Group 5 and Group 12. 

What was perceived as separate episodes, turned out to be three campaigns conducted by the threat actor UltraRank; they were named by Group-IB based on the classification that researchers use today — Campaign 2, Campaign 5 and Campaign 12. The earliest of them, Campaign 2, dates back to 2015, while Campaign 12 continues to this very day. 

In all three campaigns similar mechanisms to hide the threat actors’ server location and resembling patterns of domain registration were used. In addition, several storage locations for malicious code with identical contents were discovered in all the campaigns. What distinguishes the three operations is the choice of JS-sniffer family employed — FakeLogistics in Campaign 2, WebRank in Campaign 5, and SnifLite in Campaign 12. 

Over five years, which popped up on Group-IB researchers’ radars, UltraRank changed its infrastructure and malicious code on numerous occasions, as a result of which cybersecurity experts would wrongly attribute its attacks to other threat actors. UltraRank combined attacks on single targets with supply chain attacks, Group-IB Threat Intelligence team has managed to identify a total of 691 websites as well as 13 third-party service providers for online resources, including various advertising and browser notification services, web design agencies, marketing agencies, and website developers in Europe, Asia, North and Latin Americas infected by the group.  

Winning strategy

UltraRank went far beyond the notion of ordinary JS-sniffer operators, having developed an autonomous business model with a unique technical and organizational structure. Unlike other JS-sniffer operators that monetize the stolen bank card data by purchasing posh goods and then reselling them or cooperate with third-party carders, UltraRank created its own scheme for monetizing stolen bank card data by selling it through an affiliated card shop — ValidCC, whose infrastructure is linked to UltraRank’s one. According to the card shop’s internal statistics, its average income from the sale of bank card data was $5,000 to $7,000 per day, in a single week in 2019. Another $25,000–$30,000 was paid by ValidCC to third-party suppliers of stolen payment data. 

The store’s official representative on underground forums is a user with the nickname SPR. In many posts, SPR claims that  the card data sold in the ValidCC store was obtained using JS sniffers. Most of SPR’s posts are written in English, however, SPR often switches to Russian, while communicating with customers. This might indicate that ValidCC is probably managed by a Russian speaker.  

Another fact suggesting that UltraRank is far from an ordinary player of the cybercriminal market are the competition methods used by the group: Group-IB experts tracked UltraRank’s hacks of websites already compromised by rival cybercriminal groups and DDoS attacks on phishing pages masqueraded as the ValidCC card shop. 

“The cybercriminal market is offering better and better quality of service, fine-tuning and simplifying the instruments for solving specific tasks,” comments Group-IB Threat Intelligence analyst Victor Okorokov. “Today, JS-sniffers represent the end product of evolution of tools intended for the compromise of bank card data, considerably decreasing the resource-intensity of such attacks.  In the coming years, we will definitely see the growth in the use of this malicious instrument since many online shops and service providers still neglect their cybersecurity, using outdated CMSs that have vulnerabilities.” 

To effectively counteract the JS-sniffer threat, online merchants need to keep their software updated, carry out regular cybersecurity assessments and audits of their websites and not hesitate to seek assistance from cybersecurity specialists whenever needed.

 About Group-IB 

Group-IB is a Singapore-based provider of solutions aimed at detection and prevention of cyberattacks and online fraud. The company also specializes in high-profile cyber investigations and IP protection services. Group-IB’s Threat Intelligence system has been named one of the best in class by Gartner, Forrester, and IDC, while its Threat Detection System has been recognized as one of the leaders in Network Detection and Response. Group-IB’s technological leadership is built on the company’s 17 years of hands-on experience in cybercrime investigations around the world and 60 000 hours of cyber security incident response accumulated in one of the biggest forensic laboratories and a round-the-clock center providing a rapid response to cyber incidents — CERT-GIB. 

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, JS-sniffer)

[adrotate banner=”5″]

[adrotate banner=”13″]