During the analysis of underground cardshops, Group-IB Threat Hunting Intelligence team has detected one spike in the sale of compromised raw cards data (type of compromised card which has all the information required for online purchases, including CVV, card number and expiration date) issued by Singaporean banks. In April 2019, 4,166 cards related to Singapore were uploaded to cardshops, while the mean in January-August 2019 was at 2,379 cards per month. This spike was due to the fact that on April 1 alone, a database named «31.03-SG_MIX_SNIFF» was uploaded to an underground cardshop, which contained 1,726 compromised cards issued by the Singaporean banks.
The cards could have likely been compromised as a result of Java Script-sniffers’ activity on online stores frequented by Singaporeans, and the name of the database supports this assumption. A JS‑sniffer is the online equivalent of a traditional credit card skimmer — a small device installed on ATMs that intercepts payment card details. Usually, a few lines of code injected into websites can capture data entered by customers, such as payment card numbers, names, addresses, passwords, etc. A multi-linked chain of victims of JS-sniffers includes online shoppers, online stores, payment systems, banks. Quite often neither a customer nor a website owner can detect the activity of JS-sniffers. JS-sniffers are capable of infecting websites which use different types of CMS (Content Management System) and are hard to be detected with the use of traditional signature-based detection methods, which makes them even more dangerous.
CEO and founder at Group-IB
In the first eight months of 2019, Group-IB experts have detected 26,102 compromised payment cards issued by Singaporean banks put up for sale on dark web cardshops. The total underground market value of compromised cards detected in January-August 2019 is estimated at nearly USD 1.8 million. Among them, 19,037 were identified as raw cards data. While only 7,065 cards turned out to be «dumps» — unauthorized digital copies containing the card’s magnetic details, which can be clone to physical cards.
Notwithstanding, Singapore offers a higher level of protection compared to most countries in the Asia-Pacific region. A total of 766,055 compromised payment cards were put up for sale in January-August of this year in the rest of APAC, according to Group-IB’s data. Singaporean monetary authorities have put in place a number of security measures such as the mandatory one-time-password for card-not-present transactions and the exclusive use of EMV chip cards.