• Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
MUST READ

Italian police arrested a Chinese national suspected of cyberespionage on a U.S. warrant

 | 

U.S. CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog

 | 

IT Worker arrested for selling access in $100M PIX cyber heist

 | 

New Batavia spyware targets Russian industrial enterprises

 | 

Taiwan flags security risks in popular Chinese apps after official probe

 | 

U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog

 | 

Hunters International ransomware gang shuts down and offers free decryption keys to all victims

 | 

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 52

 | 

Security Affairs newsletter Round 531 by Pierluigi Paganini – INTERNATIONAL EDITION

 | 

North Korea-linked threat actors spread macOS NimDoor malware via fake Zoom updates

 | 

Critical Sudo bugs expose major Linux distros to local Root exploits

 | 

Google fined $314M for misusing idle Android users' data

 | 

A flaw in Catwatchful spyware exposed logins of +62,000 users

 | 

China-linked group Houken hit French organizations using zero-days

 | 

Cybercriminals Target Brazil: 248,725 Exposed in CIEE One Data Breach

 | 

Europol shuts down Archetyp Market, longest-running dark web drug marketplace

 | 

Kelly Benefits data breach has impacted 550,000 people, and the situation continues to worsen as the investigation progresses

 | 

Cisco removed the backdoor account from its Unified Communications Manager

 | 

U.S. Sanctions Russia's Aeza Group for aiding crooks with bulletproof hosting

 | 

Qantas confirms customer data breach amid Scattered Spider attacks

 | 
  • Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
  • Home
  • Breaking News
  • Hacking
  • Malware
  • Group with numerous faces: chronicle of UltraRank’s deceptive JS-sniffer campaigns

Group with numerous faces: chronicle of UltraRank’s deceptive JS-sniffer campaigns

Pierluigi Paganini August 27, 2020

Group-IB security researchers provide evidence linking three campaigns with the use of various JS-sniffer families.

Singapore – Group-IB, a global threat hunting and intelligence company headquartered in Singapore, today released its analytical report “UltraRank: the unexpected twist of a JS-sniffer triple threat.” In its report, Group-IB Threat Intelligence experts provide evidence linking three campaigns with the use of various JavaScript-sniffer families – an instrument used by cybercriminals to steal text bank card data – previously attributed by cybersecurity researchers to various Magecart groups, to the same hacker group. This group was dubbed UltraRank by Group-IB.

In the context of UltraRank, the report exemplifies the JS-sniffers’ transformation from a minor online threat into a complex one supported by organized cybercrime. In just five years, the group compromised nearly 700 websites and 13 third-party suppliers in Europe, Asia, North and Latin Americas and designed its own model to monetize the stolen text data of bank cards – through the card shop ValidCC, whose revenue exceeded $5,000 perday.  

Cybercrime prodigy

In less than a year and a half, the number of JS-sniffer families more than doubled: today, Group-IB Threat Intelligence analysts see at least 96 JS-sniffer families, while in March 2019, when Group-IB released its first research into this threat, the figure stood at 38. The continuous monitoring of underground forums and card shops, thorough analysis of the maximum possible number of existing JS-sniffer samples, as well as the search for new website infections enabled Group-IB experts to take on a new stage of research, i.e. to attribute attacks involving JS-sniffers to a particular group. 

In February 2020, Group-IB Threat Intelligence experts discovered that the US marketing company The Brandit Agency, which created project websites for its clients running content management system (CMS) Magento, was compromised. As a result, at least five websites created by the marketing agency for its clients were infected with JS-sniffers. The malware was downloaded from the host toplevelstatic[.]com. This very website was used to load the malicious script on the website of the largest manufacturer and distributor of cash handling products in North America, Block & Company.

First clue

The abovementioned attacks served as a starting point of Group-IB’s research, which resulted in the discovery of the attackers’ infrastructure that turned out to be linked to several earlier attacks involving JS-sniffers. The company’s proprietary analytics systems and a unique array of data (including samples), enabled Group-IB experts to establish connections between these incidents and already known attacks, attributed by cybersecurity researchers to three different groups, namely Group 2, Group 5 and Group 12. 

What was perceived as separate episodes, turned out to be three campaigns conducted by the threat actor UltraRank; they were named by Group-IB based on the classification that researchers use today — Campaign 2, Campaign 5 and Campaign 12. The earliest of them, Campaign 2, dates back to 2015, while Campaign 12 continues to this very day. 

In all three campaigns similar mechanisms to hide the threat actors’ server location and resembling patterns of domain registration were used. In addition, several storage locations for malicious code with identical contents were discovered in all the campaigns. What distinguishes the three operations is the choice of JS-sniffer family employed — FakeLogistics in Campaign 2, WebRank in Campaign 5, and SnifLite in Campaign 12. 

Over five years, which popped up on Group-IB researchers’ radars, UltraRank changed its infrastructure and malicious code on numerous occasions, as a result of which cybersecurity experts would wrongly attribute its attacks to other threat actors. UltraRank combined attacks on single targets with supply chain attacks, Group-IB Threat Intelligence team has managed to identify a total of 691 websites as well as 13 third-party service providers for online resources, including various advertising and browser notification services, web design agencies, marketing agencies, and website developers in Europe, Asia, North and Latin Americas infected by the group.  

Winning strategy

UltraRank went far beyond the notion of ordinary JS-sniffer operators, having developed an autonomous business model with a unique technical and organizational structure. Unlike other JS-sniffer operators that monetize the stolen bank card data by purchasing posh goods and then reselling them or cooperate with third-party carders, UltraRank created its own scheme for monetizing stolen bank card data by selling it through an affiliated card shop — ValidCC, whose infrastructure is linked to UltraRank’s one. According to the card shop’s internal statistics, its average income from the sale of bank card data was $5,000 to $7,000 per day, in a single week in 2019. Another $25,000–$30,000 was paid by ValidCC to third-party suppliers of stolen payment data. 

The store’s official representative on underground forums is a user with the nickname SPR. In many posts, SPR claims that  the card data sold in the ValidCC store was obtained using JS sniffers. Most of SPR’s posts are written in English, however, SPR often switches to Russian, while communicating with customers. This might indicate that ValidCC is probably managed by a Russian speaker.  

Another fact suggesting that UltraRank is far from an ordinary player of the cybercriminal market are the competition methods used by the group: Group-IB experts tracked UltraRank’s hacks of websites already compromised by rival cybercriminal groups and DDoS attacks on phishing pages masqueraded as the ValidCC card shop. 

“The cybercriminal market is offering better and better quality of service, fine-tuning and simplifying the instruments for solving specific tasks,” comments Group-IB Threat Intelligence analyst Victor Okorokov. “Today, JS-sniffers represent the end product of evolution of tools intended for the compromise of bank card data, considerably decreasing the resource-intensity of such attacks.  In the coming years, we will definitely see the growth in the use of this malicious instrument since many online shops and service providers still neglect their cybersecurity, using outdated CMSs that have vulnerabilities.” 

To effectively counteract the JS-sniffer threat, online merchants need to keep their software updated, carry out regular cybersecurity assessments and audits of their websites and not hesitate to seek assistance from cybersecurity specialists whenever needed.

 About Group-IB 

Group-IB is a Singapore-based provider of solutions aimed at detection and prevention of cyberattacks and online fraud. The company also specializes in high-profile cyber investigations and IP protection services. Group-IB’s Threat Intelligence system has been named one of the best in class by Gartner, Forrester, and IDC, while its Threat Detection System has been recognized as one of the leaders in Network Detection and Response. Group-IB’s technological leadership is built on the company’s 17 years of hands-on experience in cybercrime investigations around the world and 60 000 hours of cyber security incident response accumulated in one of the biggest forensic laboratories and a round-the-clock center providing a rapid response to cyber incidents — CERT-GIB. 

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, JS-sniffer)

[adrotate banner=”5″]

[adrotate banner=”13″]


facebook linkedin twitter

Cybercrime Hacking hacking news information security news IT Information Security JS-sniffer malware Pierluigi Paganini Security Affairs Security News UltraRank

you might also like

Pierluigi Paganini July 08, 2025
Italian police arrested a Chinese national suspected of cyberespionage on a U.S. warrant
Read more
Pierluigi Paganini July 08, 2025
U.S. CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog
Read more

leave a comment

newsletter

Subscribe to my email list and stay
up-to-date!

    recent articles

    Italian police arrested a Chinese national suspected of cyberespionage on a U.S. warrant

    Intelligence / July 08, 2025

    U.S. CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog

    Hacking / July 08, 2025

    IT Worker arrested for selling access in $100M PIX cyber heist

    Cyber Crime / July 08, 2025

    New Batavia spyware targets Russian industrial enterprises

    Malware / July 07, 2025

    Taiwan flags security risks in popular Chinese apps after official probe

    Security / July 07, 2025

    To contact me write an email to:

    Pierluigi Paganini :
    pierluigi.paganini@securityaffairs.co

    LEARN MORE

    QUICK LINKS

    • Home
    • Cyber Crime
    • Cyber warfare
    • APT
    • Data Breach
    • Deep Web
    • Digital ID
    • Hacking
    • Hacktivism
    • Intelligence
    • Internet of Things
    • Laws and regulations
    • Malware
    • Mobile
    • Reports
    • Security
    • Social Networks
    • Terrorism
    • ICS-SCADA
    • POLICIES
    • Contact me

    Copyright@securityaffairs 2024

    We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.
    Cookie SettingsAccept All
    Manage consent

    Privacy Overview

    This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities...
    Necessary
    Always Enabled
    Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
    Non-necessary
    Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
    SAVE & ACCEPT