Your organization’s leadership is 12 times more likely to be the target of a security incident and nine times more likely to be the target of a data breach than they were last year. Find out how they can be protected.
Read the Datasheet
Gift Cardsharks: The Massive Threat Campaigns Circling Beneath the Surface
Learn about the attack group primarily targeting gift card retailers and the monetization techniques they use.
Get the Report
Threat Hunting Workshop Series
Join one of our security threat hunting workshops to get hands-on experience investigating and remediating threats.
Attend an Upcoming Workshop
Inside Magecart: New RiskIQ & Flashpoint Research Report
Learn about the groups and criminal underworld behind the front-page breaches.
Threat Hunting Guide: 3 Must-Haves for the Effective Modern Threat Hunter
The threat hunting landscape is constantly evolving. Learn the techniques, tactics, and tools needed to become a highly-effective threat hunter.
Magecart is back, and the operation is more elaborate than we thought, involving physical shipping companies with mules operating in the United States.
Credit card data is a hot commodity in the criminal underworld of the internet—stolen card data is readily available, and used to fund criminal enterprises of all kinds. But scammers, rippers, and carders aren’t the only ones in on the action—the data has to be stolen in the first place.
This stolen data can be packaged and sold as CVV dumps, on websites where transactions involving stolen credit card data take place. In a recent Krebs on Security blog post, which ties Magecart infrastructure listed in our original report to a credit card dump website known as “Trump’s Dumps,” we caught a glimpse of how those behind Magecart are monetizing their operations.
By pivoting on a domain related to known Magecart activity in RiskIQ PassiveTotal, the team found that the server behind its IP address, currently used for the injects of the Magecart script, also links to a domain for a reshipping company website falsely advertised as a freight/logistics provider, USLOGISTICEXPRESS.COM.
Fig-1 Pivoting on 126.96.36.199 in PassiveTotal
Fig-2 HTTP default virtual host on 188.8.131.52 exposes uslogisticexpress.com
If we look at this fake company name, we can find a registration of it online:
Fig-3 Company profile of “logistics provider” International Express (uslogisticexpress.com)
Via false employment ads on Russian job websites for U.S.-based job seekers, mules are recruited under the pretense of “transport agents,” tasked with receiving shipments of electronics and other goods bought with stolen credit cards to ship to an address in Eastern Europe. This technique is similar to more traditional schemes involving money mules, but rather than a direct transfer of funds, the actors behind Magecart transfer funds into higher priced goods, which can be shipped across borders without suspicion, then sold for a hefty profit.
Below is a very obvious reshipping request for U.S.-based residents to help out as mules. Both of the adverts were put up on websites advertising jobs for U.S. and Russian employees and employers:
Fig-4 English language job posting for a transport agent on Russian/American news site
Online stores remain one of the easiest ways to capture payment card data, so we don’t anticipate threats like this to go away anytime soon. A lack of overall protection on many online stores and the level of ease by which criminals may gain access to vulnerable web applications lead to successful fraud operations like Magecart, supporting our belief that attackers are attempting to capitalize on this period before additional safeguards can be enacted in the ecosystem to heavily target online stores.
Visit the Magecart Public Project in RiskIQ PassiveTotal to pivot on IOCs related to this threat.
Questions? Feedback? Email firstname.lastname@example.org to contact our research team.
RiskIQ is the leader in attack surface management. We help organizations discover, understand, and mitigate exposures across all digital channels.
🛡️#CyberSecurityBrief #Alert: @FTC Refunds Victims Of @OfficeDepot Tech Support Scam via @BleepinComputer @AthertonLab #CyberSecurity #InfoSec #Malware #Ransomware #DDoS #DataBreach #ITsecurity #CyberThreats #CloudSecurity #CyberSecurityInsights https://cybersecurityinsights.substack.com/p/your-friday-morning-cybersecurity?r=63k3&utm_campaign=post&utm_medium=web&utm_source=twitter
At #RSAC2020, stop by the @CrowdStrike booth on Tuesday at 11:30 to see the RiskIQ Illuminate app in action! It analyzes CrowdStrike endpoint coverage and compares it to RiskIQ's unmatched external data to provide a 360-degree view of your attack surface: https://bit.ly/2ujagwt
Credit Card Skimmer Found on Nine Sites, Researchers Ignored - by @Ionut_Ilascu
Looking for plans in San Francisco Monday night during #RSAC 2020? You're invited to party with RiskIQ at IGNITE, hosted by @FlashpointIntel! RSVP today: https://bit.ly/2R1SPJe