Full Report
Group-IB specialists detected GrelosGTM group started to abuse Google Tag Manager legitimate functionality for their own purposes in infections of online shops.
Analysis Summary
# Threat Actor: GrelosGTM
## Attribution & Identity
**GrelosGTM** is a cybercriminal group specializing in JavaScript (JS) sniffing. The group is identified by its specific abuse of legitimate Google Tag Manager (GTM) infrastructure to facilitate infections. They are part of the broader "Magecart" landscape of threat actors who target e-commerce checkout processes.
## Activity Summary
Since at least February 2021, GrelosGTM has conducted campaigns targeting online shops to steal payment card data. The group distinguishes itself by using Google Tag Manager as an initial infection vector or as a delivery mechanism for their malicious scripts. In recent operations, the actor has been observed infecting Magento-based websites by injecting GTM scripts that subsequently load obfuscated sniffers via WebSockets.
## Tactics, Techniques & Procedures
- **Initial Access:** Injection of malicious code into the source code of targeted websites, specifically targeting Magento CMS.
- **Legitimate Service Abuse:** Abuse of Google Tag Manager (`googletagmanager[.]com`) to host or trigger malicious scripts, allowing the traffic to blend in with legitimate analytics services.
- **WebSocket Communication:** Use of WebSockets (`wss://`) to download the main JS sniffer payload, a technique used to evade traditional network security monitoring that looks for standard HTTP requests.
- **Data Exfiltration:** Collecting bank card information via fake payment forms and exfiltrating data to actor-controlled C2 gates disguised as image files (`.img`).
- **Obfuscation:** Use of heavy JavaScript obfuscation to hinder analysis and detection by security scanners.
**MITRE ATT&CK Mapping:**
- **T1592:** Gather Victim Host Information (Detecting checkout pages via RegEx)
- **T1102:** Ability to use Web Service (Google Tag Manager)
- **T1071.001:** Application Layer Protocol: Web Protocols (WebSocket usage)
- **T1041:** Exfiltration Over C2 Channel
## Targeting
- **Sectors:** E-commerce / Online Retail.
- **Geography:** Belgium, Italy, the United Kingdom, and the United States.
- **Victims:** Websites running the Magento Content Management System (CMS). At least seven websites were identified in the initial report.
## Tools & Infrastructure
- **Malware:** GrelosGTM JS Sniffer (WebSocket-based injector).
- **Infrastructure:**
- `webfaset[.]com` (C2 and script hosting)
- `fountm[.]online`
- `jqwereid[.]online`
- `bulder[.]online`
- `gstatcs[.]com`
- `hXXps://www.googletagmanager[.]com/gtm.js?id=GTM-5SF293J` (Malicious GTM Container)
- `hXXs://webfaset[.]com/media/logo.img` (Exfiltration Gate)
## Implications
GrelosGTM represents a sophisticated evolution in the Magecart threat landscape. By leveraging WebSockets and trusted domains like Google Tag Manager, they significantly lower their footprint on the client side. This approach makes detection difficult for standard Web Application Firewalls (WAFs) and static site scanners, posing a high risk to small-to-medium e-commerce businesses that rely on third-party scripts for site functionality.
## Mitigations
- **Content Security Policy (CSP):** Implement strict CSP headers to restrict where scripts can be loaded from and where data can be sent (specifically controlling `connect-src` to limit WebSocket connections).
- **Subresource Integrity (SRI):** Use SRI hashes for all third-party scripts to ensure that if a script is modified at the source, it will not execute.
- **Audit Third-Party Scripts:** Regularly audit Google Tag Manager containers for unauthorized scripts, tags, or triggers.
- **Monitor CMS Integrity:** Use file integrity monitoring for Magento installations to detect unauthorized injections into the core source code or database.
- **Payment Page Isolation:** Use hosted payment gateways (iFrames) from reputable providers to minimize the surface area exposed to JS sniffers.