Group with numerous faces: chronicle of UltraRank’s deceptive JS-sniffer campaigns

Group-IB, a global threat hunting and intelligence company headquartered in Singapore, today released its analytical report “UltraRank: the unexpected twist of a JS sniffer triple threat.” In its report, Group-IB Threat Intelligence experts provide evidence linking three campaigns with the use of various JavaScript-sniffer families an instrument used by cybercriminals to steal text bank card data previously attributed by cybersecurity researchers to various Magecart groups, to the same hacker group. This group was dubbed UltraRank by Group-IB. In the context of UltraRank, the report exemplifies the JS sniffers’ transformation from a minor online threat into a complex one supported by organized cybercrime. In just five years, the group compromised nearly 700 websites and 13 third-party suppliers in Europe, Asia, North and Latin Americas and designed its own model to monetize the stolen text data of bank cards through the card shop ValidCC, whose revenue exceeded $5,000 per day.

Cybercrime prodigy

In less than a year and a half, the number of JS sniffer families more than doubled: today, Group-IB Threat Intelligence analysts see at least 96 JS sniffer families, while in March 2019, when Group-IB released its first research into this threat, the figure stood at 38. The continuous monitoring of underground forums and card shops, thorough analysis of the maximum possible number of existing JS sniffer samples, as well as the search for new website infections enabled Group-IB experts to take on a new stage of research, i.e. to attribute attacks involving JS sniffers to a particular group.

In February 2020, Group-IB Threat Intelligence experts discovered that the US marketing company The Brandit Agency, which created project websites for its clients running content management system (CMS) Magento, was compromised. As a result, at least five websites created by the marketing agency for its clients were infected with JS-sniffers. The malware was downloaded from the host toplevelstatic[.]com. This very website was used to load the malicious script on the website of the largest manufacturer and distributor of cash handling products in North America, Block & Company.

First clue

The abovementioned attacks served as a starting point of Group-IB’s research, which resulted in the discovery of the attackers’ infrastructure that turned out to be linked to several earlier attacks involving JS sniffers. The company’s proprietary analytics systems and a unique array of data (including samples), enabled Group-IB experts to establish connections between these incidents and already known attacks, attributed by cybersecurity researchers to three different groups, namely Group 2, Group 5 and Group 12.

What was perceived as separate episodes, turned out to be three campaigns conducted by the threat actor UltraRank; they were named by Group-IB based on the classification that researchers use today Campaign 2, Campaign 5 and Campaign 12. The earliest of them, Campaign 2, dates back to 2015, while Campaign 12 continues to this very day.

In all three campaigns similar mechanisms to hide the threat actors’ server location and resembling patterns of domain registration were used. In addition, several storage locations for malicious code with identical contents were discovered in all the campaigns. What distinguishes the three operations is the choice of JS sniffer family employed FakeLogistics in Campaign 2, WebRank in Campaign 5, and SnifLite in Campaign 12.

Over five years, which popped up on Group-IB researchers’ radars, UltraRank changed its infrastructure and malicious code on numerous occasions, as a result of which cybersecurity experts would wrongly attribute its attacks to other threat actors. UltraRank combined attacks on single targets with supply chain attacks, Group-IB Threat Intelligence team has managed to identify a total of 691 websites as well as 13 third-party service providers for online resources, including various advertising and browser notification services, web design agencies, marketing agencies, and website developers in Europe, Asia, North and Latin Americas infected by the group.

Winning strategy

UltraRank went far beyond the notion of ordinary JS sniffer operators, having developed an autonomous business model with a unique technical and organizational structure. Unlike other JS sniffer operators that monetize the stolen bank card data by purchasing posh goods and then reselling them or cooperate with third-party carders, UltraRank created its own scheme for monetizing stolen bank card data by selling it through an affiliated card shop ValidCC, whose infrastructure is linked to UltraRank’s one. According to the card shop’s internal statistics, its average income from the sale of bank card data was $5,000 to $7,000 per day, in a single week in 2019. Another $25,000-$30,000 was paid by ValidCC to third-party suppliers of stolen payment data.

The store’s official representative on underground forums is a user with the nickname SPR. In many posts, SPR claims that the card data sold in the ValidCC store was obtained using JS sniffers. Most of SPR’s posts are written in English, however, SPR often switches to Russian, while communicating with customers. This might indicate that ValidCC is probably managed by a Russian speaker.

Another fact suggesting that UltraRank is far from an ordinary player of the cybercriminal market are the competition methods used by the group: Group-IB experts tracked UltraRank’s hacks of websites already compromised by rival cybercriminal groups and DDoS attacks on phishing pages masqueraded as the ValidCC card shop.

The cybercriminal market is offering better and better quality of service, fine-tuning and simplifying the instruments for solving specific tasks. Today, JS sniffers represent the end product of evolution of tools intended for the compromise of bank card data, considerably decreasing the resource-intensity of such attacks. In the coming years, we will definitely see the growth in the use of this malicious instrument since many online shops and service providers still neglect their cybersecurity, using outdated CMSs that have vulnerabilities.

Victor Okorokov
Victor Okorokov

Group-IB Threat Intelligence analyst

To effectively counteract the JS-sniffer threat, online merchants need to keep their software updated, carry out regular cybersecurity assessments and audits of their websites and not hesitate to seek assistance from cybersecurity specialists whenever needed.

About Group-IB

Group-IB, with its headquarters in Singapore, is one of the leading providers of solutions dedicated to detecting and preventing cyberattacks, identifying online fraud, investigating high-tech crimes, and protecting intellectual property. The company’s Threat Intelligence and Research Centers are located in the Middle East (Dubai), the Asia-Pacific (Singapore), and Europe (Amsterdam).

Group-IB’s Unified Risk Platform is an ecosystem of solutions that understands each organization’s threat profile and tailors defenses against them in real-time from a single interface. The Unified Risk Platform provides complete coverage of the cyber response chain. Group-IB’s products and services consolidated in Group-IB’s Unified Risk Platform include Group-IB’s Threat IntelligenceManaged XDRDigital Risk ProtectionFraud ProtectionAttack Surface ManagementBusiness Email ProtectionAudit & ConsultingEducation & TrainingDigital Forensics & Incident ResponseManaged Detection & Response, and Cyber Investigations.

Group-IB’s technological leadership and R&D capabilities are built on the company’s 19 years of hands-on experience in cybercrime investigations worldwide and more than 70,000 hours of cybersecurity incident response accumulated in our leading DFIR Laboratory, High-Tech Crime Investigations Department, and round-the-clock CERT-GIB.

Group-IB is an active partner in global investigations led by international law enforcement organizations such as Europol and INTERPOL. Group-IB is also a member of the Europol European Cybercrime Centre’s (EC3) Advisory Group on Internet Security, which was created to foster closer cooperation between Europol and its leading non-law enforcement partners.

Group-IB’s experience in threat hunting and cyber intelligence has been fused into an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyberattacks. Group-IB’s mission is to protect its clients in cyberspace every day by creating and leveraging innovative solutions and services.

Group-IB’s experience in threat hunting and cyber intelligence has been fused into an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyberattacks. Group-IB’s mission is to fight high-tech crime while protecting our clients in cyberspace and helping them achieve their goals. To do so, we analyze cyber threats, develop our infrastructure to monitor them, respond to incidents, investigate complex high-tech crimes, and design unique technologies, solutions, and services to counteract adversaries.