UltraRank JS-Sniffer Campaigns Stole Card Data From Hundreds of Sites
August 28, 2020
Victor Okorokov, Group-IB Threat
Intelligence analyst said, "To effectively counteract the JS-sniffer
threat, online merchants need to keep their software updated, carry out
regular cybersecurity assessments and audits of their websites and not
hesitate to seek assistance from cybersecurity specialists whenever
Over five years, which popped up on Group-IB researchers’ radars, UltraRank changed its infrastructure and malicious code on numerous occasions, as a result of which cybersecurity experts would wrongly attribute its attacks to other threat actors. UltraRank combined attacks on single targets with supply chain attacks, Group-IB Threat Intelligence team has managed to identify a total of 691 websites as well as 13 third-party service providers for online resources, including various advertising and browser notification services, web design agencies, marketing agencies, and website developers in Europe, Asia, North and Latin Americas infected by the group.
UltraRank went far beyond the notion of ordinary JS sniffer operators, having developed an autonomous business model with a unique technical and organizational structure. Unlike other JS sniffer operators that monetize the stolen bank card data by purchasing posh goods and then reselling them or cooperate with third-party carders, UltraRank created its own scheme for monetizing stolen bank card data by selling it through an affiliated card shop — ValidCC, whose infrastructure is linked to UltraRank’s one. According to the card shop’s internal statistics, its average income from the sale of bank card data was $5,000 to $7,000 per day, in a single week in 2019. Another $25,000-$30,000 was paid by ValidCC to third-party suppliers of stolen payment data.
The store’s official representative on underground forums is a user with the nickname SPR. In many posts, SPR claims that the card data sold in the ValidCC store was obtained using JS sniffers. Most of SPR’s posts are written in English, however, SPR often switches to Russian, while communicating with customers. This might indicate that ValidCC is probably managed by a Russian speaker.
Another fact suggesting that UltraRank is far from an ordinary player of the cybercriminal market are the competition methods used by the group: Group-IB experts tracked UltraRank’s hacks of websites already compromised by rival cybercriminal groups and DDoS attacks on phishing pages masqueraded as the ValidCC card shop.
The cybercriminal market is offering better and better quality of service, fine-tuning and simplifying the instruments for solving specific tasks. Today, JS sniffers represent the end product of evolution of tools intended for the compromise of bank card data, considerably decreasing the resource-intensity of such attacks. In the coming years, we will definitely see the growth in the use of this malicious instrument since many online shops and service providers still neglect their cybersecurity, using outdated CMSs that have vulnerabilities.