Full Report
As part of UltraRank's new campaign, Group-IB Threat Intelligence team discovered 12 eCommerce websites infected with their JavaScript-sniffer.
Analysis Summary
# Threat Actor: UltraRank
## Attribution & Identity
UltraRank is a sophisticated cybercriminal group categorized as a JS-sniffer operator. While often associated with the broader "Magecart" umbrella (specifically linked to patterns seen in **Magecart Group 2** and **Group 5**), UltraRank is distinguished by its unique infrastructure and long-term operational consistency.
* **Aliases:** None officially confirmed beyond associations with Magecart Group 2/5 patterns.
* **Associations:** Known for supplying or operating independent infrastructure that has previously been linked to high-profile attacks on companies like Ticketmaster (via the SociaPlus incident).
## Activity Summary
The Group-IB Threat Intelligence team recently identified a new campaign by UltraRank targeting eCommerce platforms. In this latest wave, the actor successfully infected **12 eCommerce websites** with a proprietary JavaScript sniffer designed to intercept payment card data in real-time. This campaign demonstrates the actor’s continued persistence and evolution in the digital skimming landscape.
## Tactics, Techniques & Procedures
UltraRank utilizes advanced obfuscation and supply-chain attack methods to remain undetected.
* **Malicious Script Injection:** Inserting malicious JavaScript (JS-sniffers) into the checkout pages of eCommerce sites.
* **Supply Chain Attacks:** Compromising third-party service providers (e.g., advertising or analytics modules) to distribute the sniffer across multiple downstream victims.
* **Code Obfuscation:** Using multi-layered obfuscation to hide the sniffer's functionality from automated scanners.
* **Dynamic Data Exfiltration:** The sniffer monitors payment forms and exfiltrates data (Card numbers, CVV, expiry, PII) directly to actor-controlled C2 servers.
**MITRE ATT&CK IDs:**
* **T1592:** Gather Victim Host Information
* **T1534:** Internal Spearphishing (often used for initial access to CMS)
* **T1553.003:** Subvert Trust Controls: SIP and Trust Provider Hijacking
* **T1059.007:** Command and Scripting Interpreter: JavaScript
## Targeting
* **Sectors:** eCommerce, Online Retail, and any service processing online bank card payments.
* **Geography:** Global distribution; the actor targets high-traffic sites regardless of region to maximize data collection.
* **Victims:** 12 eCommerce websites (Specific names were not disclosed in the excerpt, but historical victims include third-party providers like SociaPlus).
## Tools & Infrastructure
* **Malware Families:** **UltraRank JS-Sniffer** (a unique, evolving codebase).
* **Infrastructure:**
* **C2/Exfiltration Domains:** The actor frequently uses domains that masquerade as legitimate services (e.g., analytics or social media integration tools).
* **Defanged Examples (Based on historical UltraRank patterns):**
* `t-ds[.]org`
* `m-stats[.]com`
* `click-stat[.]com`
## Implications
UltraRank represents a Tier-1 threat to the eCommerce ecosystem. Their ability to maintain long-term campaigns and compromise third-party libraries means that even well-secured websites are at risk through their supply chain. The high quality of their code suggests a well-funded, professional cybercrime operation focused on long-term monetization rather than "smash and grab" attacks.
## Mitigations
* **For eCommerce Admins:**
* Implement a strict **Content Security Policy (CSP)** to restrict which domains can execute scripts and where data can be sent.
* Use **Subresource Integrity (SRI)** to ensure that third-party scripts have not been modified.
* Regularly audit CMS installations (Magento, Shopify, WooCommerce) and use tools like the *Magento Security Scan Tool*.
* Enforce Multi-Factor Authentication (MFA) for all administrative panels (phpMyAdmin, Adminer).
* **For Banks:**
* Monitor for common points of purchase (CPP) among compromised cards to identify infected merchants early.
* Enhance 3D-Secure (3DS) implementations to require out-of-band authentication for transactions.
* **General:**
* Employ automated file-integrity monitoring to detect unauthorized changes to JS files on web servers.