UltraRank: The Unexpected Twist of a JS-Sniffer Threat

In this report

For five years, the cybercriminal group UltraRank has conducted campaigns using JS-sniffers, improved their infrastructure, created monetization instruments, and modified malicious code.

The group’s arsenal includes both standalone attacks and attacks on third-party suppliers. UltraRank has also hijacked tools created by its competitors and confronted hackers who imitated a cardshop associated with the group.

Given that investigators have attributed many of UltraRank’s attacks to other threat actors, the group has managed to stay unnoticed for the most part.

At the moment the group remains active, with their latest infections being detected in June 2020.

691 online stores and 13 third-party suppliers

for websites were attacked by UltraRank. Total number of infected sites may reach 100K

$5,000-7,000

is the daily estimated income of a cardshop connected with the group’s infrastructure

At least 3 campaigns

led by UltraRank were previously attributed to other groups by researchers

During its activity, UltraRank has built an autonomous business model with a unique technical and organizational structure, as well as its own sales and monetization system for stolen bank card data. The group is not an ordinary player in this criminal market, which is also proven by their methods of competitive struggle: Group-IB experts recorded UltraRank’s attacks on competing groups, as well as on phishing pages imitating cardshop associated with cybercriminals.

Excerpt from the report