Full Report
Group-IB discovered that the stolen payment cards data is sold through an underground store specially created for this purpose.
Analysis Summary
# Tool/Technique: G-Analytics (JS-Sniffer Family)
## Overview
G-Analytics is a family of JavaScript sniffers (JS-sniffers) designed to infect e-commerce websites to steal payment card data. The malware operates by intercepting information entered by users into checkout forms in real-time. Group-IB research indicates this family is likely operated by the same individuals managing the **Cardsurfs (Flysurfs)** underground carding shop, providing a direct pipeline from theft to monetization.
## Technical Details
- **Type:** Malware (JS-Sniffer / Magecart-style)
- **Platform:** Web-based (e-commerce platforms, browsers)
- **Capabilities:** Form grabbing, payment data exfiltration, domain shadowing/typosquatting.
- **First Seen:** Approximately 2016 (earliest associated domains).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise]
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1555 - Credentials from Web Browsers]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Form Sniffing:** Injects malicious JavaScript into payment pages to monitor `input`, `select`, and `textarea` fields.
- **Data Exfiltration:** Automatically captures and sends credit card numbers, CVV codes, expiration dates, and personal information to attacker-controlled C2 domains.
- **Obfuscation:** The scripts often masquerade as legitimate third-party services, particularly Google Analytics, to evade detection by site administrators.
### Advanced Features
- **Integrated Ecosystem:** Linked directly to the **Cardsurfs** underground marketplace, allowing for immediate automated listing of stolen credit card data.
- **Infrastructure Overlap:** Uses common registration details and hosting servers across multiple sniffing campaigns and the card shop itself.
- **Cookie Stealing:** Some variants have been associated with logs from dedicated "Cookie Stealer" tools to hijack user sessions.
## Indicators of Compromise
### Network Indicators
- hxxps://g-analytics[.]com/libs/1.0.5/analytics.js
- hxxps://g-analytics[.]com/libs/1.0.9/analytics.js
- hxxps://g-analytics[.]com/libs/analytics.js
- hxxps://google-analytics[.]cm
- hxxps://google-analytics[.]is
- hxxps://googlc-analytics[.]cm (Typosquatting)
- hxxps://analytic[.]to
- hxxps://analytic[.]is
- hxxps://iozoz[.]com
- hxxps://dittm[.]org
- hxxps://jquery-js[.]com
- hxxps://cardz[.]vc (Carding Shop)
- hxxps://cardz[.]su (Carding Shop)
### Behavioral Indicators
- Unexpected outbound network requests to unauthorized domains during the checkout process.
- Modification of web page DOM elements, specifically adding event listeners to payment forms.
- Inclusion of external JS files from domains mimicking legitimate analytics or library services.
## Associated Threat Actors
- **Cardsurfs (also known as Flysurfs)** - Underground shop operators.
## Detection Methods
- **Behavioral Detection:** Monitor for unauthorized external scripts attempting to access sensitive input fields or sensitive data (PII/PCI) within the browser environment.
- **Content Security Policy (CSP):** Detect violations where scripts attempt to send data to non-whitelisted domains.
- **Integrity Monitoring:** Use Subresource Integrity (SRI) and file integrity monitoring to detect changes to local JS files or the injection of new script tags.
- **YARA Rules:** Develop rules targeting specific JS patterns used by G-Analytics, such as their specific obfuscation routines and C2 communication strings.
## Mitigation Strategies
- **Content Security Policy (CSP):** Implement a strict CSP to restrict which domains can execute scripts and where data can be exfiltrated.
- **Third-Party Risk Management:** Regularly audit all third-party scripts (analytics, chatbots, ads) running on checkout pages.
- **Patch Management:** Ensure e-commerce platforms (Magento, Shopify, etc.) and plugins are updated to the latest secure versions.
- **PCI DSS Compliance:** Adhere to Payment Card Industry Data Security Standards, including regular vulnerability scanning.
## Related Tools/Techniques
- **Magecart:** The broader umbrella of JS-sniffing groups.
- **Inter (JS-Sniffer Family):** Another prominent sniffer family.
- **Formjacking:** The general technique of hijacking web forms to steal data.