Full Report
Group-IB researchers discovered Illum JS-sniffers family designed to steal payment data of customers of online stores.
Analysis Summary
# Tool/Technique: Illum JS-sniffer
## Overview
Illum is a family of JavaScript (JS) sniffers designed to intercept and steal sensitive customer information, primarily credit card data and personally identifiable information (PII), from online e-commerce platforms. It belongs to the broader category of "Magecart" style attacks where malicious scripts are injected into checkout pages.
## Technical Details
- **Type:** Malware family (JS-sniffer / Web Skimmer)
- **Platform:** Web-based (Targeting CMS like Magento, and general e-commerce payment pages)
- **Capabilities:** Form grabbing, fake payment form injection, data exfiltration, bypass of original payment processing.
- **First Seen:** Approximately November 2016 (based on domain registration dates).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application] (e.g., CVE-2016-4010 in Magento)
- **[TA0003 - Persistence]**
- [T1505.003 - Server Software Component: Web Shell] (Injecting scripts into footers/headers)
- **[TA0009 - Collection]**
- [T1185 - Browser Session Hijacking]
- [T1539 - Steal Web Cookies]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel] (HTTP POST/GET to gates)
## Functionality
### Core Capabilities
- **Payment Data Interception:** Automatically captures data entered into standard HTML input fields on checkout pages.
- **Gate Exfiltration:** Sends stolen data to attacker-controlled C2 "gates" via HTTP requests.
- **Cross-Platform Compatibility:** Features specific modules tailored for different e-commerce engines, particularly Magento.
### Advanced Features
- **Fake Form Injection:** The malware can hide original legitimate payment forms and replace them with visually identical fake forms (e.g., fake PayPal forms) to ensure data is captured even if the site uses external payment processors.
- **Obfuscation/Encryption:** Uses specialized scripts (e.g., `payment_redcrypt.js`) to encrypt or encode data before exfiltration to evade simple network detection.
- **Targeted Logic:** Includes specific scripts for different scenarios:
- `all_inputs.js`: Universal sniffer for all input fields.
- `payment_redirect.js`: Intercepts the user journey and redirects to malicious domains.
## Indicators of Compromise
### Network Indicators (Defanged)
- **C2 Domains/Gates:**
- cdn.illum[.]pw
- sr.illum[.]pw
- request.payrightnow[.]cf
- records.nstatistics[.]com
- paymentnow[.]tk
- payment-line[.]tk
- paymentpal[.]cf
- requestnet[.]tk
- **Specific Script Paths:**
- hxxp://sr.illum[.]pw/mjs/segapay_standart.js
- hxxp://sr.illum[.]pw/magento/payment_redcrypt.js
- hxxp://request.payrightnow[.]cf/alldata.php
### Behavioral Indicators
- Unexpected outbound network requests to unknown third-party domains during the checkout process.
- Modification of the website’s footer or header to include external JS files.
- The appearance of duplicate or slightly altered payment forms on the checkout page.
## Associated Threat Actors
- **Magecart Groups:** While specific attribution to a numbered group is often fluid, Illum is associated with specialized JS-sniffer cybercrime syndicates focused on financial theft.
## Detection Methods
- **Behavioral detection:** Monitoring for unauthorized changes to the DOM (Document Object Model) or unexpected script executions on sensitive pages.
- **Content Security Policy (CSP):** Detecting violations when scripts try to send data to domains not explicitly whitelisted.
- **File Integrity Monitoring (FIM):** Scanning web server files (especially CMS templates and JS libraries) for unauthorized modifications.
## Mitigation Strategies
- **Patch Management:** Keep e-commerce CMS platforms (like Magento) updated to prevent exploitation of known vulnerabilities like CVE-2016-4010.
- **Content Security Policy (CSP):** Implement a strict CSP to prevent scripts from loading from unauthorized domains and to block data exfiltration to unknown endpoints.
- **Subresource Integrity (SRI):** Use SRI hashes for all third-party scripts to ensure they haven't been tampered with.
- **Regular Audits:** Conduct frequent security scans of the checkout flow to ensure no "rogue" scripts are present.
## Related Tools/Techniques
- **Magecart:** The umbrella term for various groups using JS-sniffers.
- **Ant and Shopper:** Other JS-sniffer families with similar modular structures.
- **Web Skimming:** The general technique of stealing information via client-side scripts.