Full Report
ReactGet is one of the most interesting families of JS-sniffers, designed to steal banking cards data from online stores.
Analysis Summary
# Tool/Technique: ReactGet
## Overview
ReactGet is a sophisticated family of JS-sniffers (JavaScript sniffers) specifically engineered to intercept and steal payment card data from online retail stores. It functions as a digital skimmer, operating on the client-side within the victim's browser when they visit a compromised e-commerce site.
## Technical Details
- **Type:** Malware Family (JS-sniffer / Magecart)
- **Platform:** Web Browsers (Targeting e-commerce platforms like Magento, WooCommerce, Shopify, etc.)
- **Capabilities:** Form grabbing, payment gateway specific targeting, data exfiltration, obfuscation.
- **First Seen:** Approximately 2018 (Based on versioning and domain registration history).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application] (Compromising the CMS/E-commerce platform)
- [T1195.002 - Supply Chain Compromise: Software Dependencies]
- **[TA0003 - Persistence]**
- [T1505.003 - Server Software Component: Web Shell] (Used to inject the sniffer code)
- **[TA0007 - Discovery]**
- [T1083 - File and Directory Discovery] (Searching for checkout pages)
- **[TA0009 - Collection]**
- [T1005 - Data from Local System]
- [T1056.001 - Input Capture: Keylogging] (Form grabbing)
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Targeted Form Grabbing:** The script monitors for specific input fields related to credit card numbers (PAN), CVV/CVC, expiry dates, and billing addresses.
- **Gateway Identification:** The sniffer includes logic to identify which payment processor the site is using (e.g., PayPal, Authorize.Net, Stripe) and adapts its scraping technique to match the specific checkout flow.
- **Data Serialization:** Collected information is formatted (often Base64 encoded or JSON serialized) before being sent to the attacker's server.
### Advanced Features
- **Versioned Payload Management:** ReactGet uses a structured versioning system (e.g., v4.2.3) where different versions are specifically tuned for different payment gateways (e.g., v4.2.5 for Adyen, v4.2.7 for PayPal).
- **Legitimate Service Mimicry:** The malware often hosts its malicious scripts on domains that mimic legitimate libraries or analytics services (e.g., `reactjsapi[.]com`, `tagstracking[.]com`).
## Indicators of Compromise
### Network Indicators (Defanged)
- **Malicious Domains/URLs:**
- hxxps://reactjsapi[.]com/api.js
- hxxps://reactjsapi[.]com/react.js
- hxxps://tagstracking[.]com/tag.js
- hxxps://tagsmediaget[.]com/react.js
- hxxps://sydneysalonsupplies[.]com/gtm.js (Compromised legitimate domain used for hosting)
- **C2/Exfiltration Endpoints:**
- Often the same as the script source or a variation within the same domain structure using `/api/` or `/log/` endpoints.
### Behavioral Indicators
- Unexpected external JavaScript requests during the checkout process.
- POST requests containing encoded payment data sent to domains not associated with the merchant or the payment processor.
## Associated Threat Actors
- **Magecart Groups:** Often associated with Magecart Group 4 or similar financially motivated cybercrime syndicates specializing in digital skimming.
## Detection Methods
- **Signature-based detection:** Monitoring for specific ReactGet script patterns (variable names like `_rct` or specific obfuscation routines).
- **Behavioral detection:** Using Content Security Policy (CSP) reports to identify unauthorized external script execution or data exfiltration attempts.
- **Integrity Monitoring:** Regularly checking for unauthorized changes to `header.php`, `footer.php`, or checkout-related JavaScript files in the web server directory.
## Mitigation Strategies
- **Content Security Policy (CSP):** Implement a strict CSP to restrict which domains can execute scripts and where data can be sent.
- **Subresource Integrity (SRI):** Use SRI tags for all third-party scripts to ensure that if a library is compromised, it will not execute.
- **Regular Patching:** Keep e-commerce platforms (Magento, etc.) and all plugins updated to prevent initial entry via known vulnerabilities.
- **Multi-Factor Authentication (MFA):** Enforce MFA for all administrative access to the website backend to prevent unauthorized code injection.
## Related Tools/Techniques
- **Grelos:** Another widespread JS-sniffer family.
- **Inter:** A common sniffer kit used by multiple actors.
- **Digital Skimming / Magecart:** The broader umbrella of techniques for client-side data theft.