UltraRank

Also known as: UltraRank

(Group-IB) In August 2020, Group-IB published the report ‘UltraRank: the unexpected twist of a JS-sniffer triple threat’. The report described the operations of the cybercriminal group UltraRank, which in five years of activity had successfully attacked 691 eCommerce stores and 13 website service providers. In November 2020, Group-IB experts discovered a new wave of UltraRank attacks. Even though new attacks were detected at the time, part of the group’s infrastructure remained active and some sites were still infected. The cybercriminals did not use existing domains for new attacks but switched to a new infrastructure to store malicious code and collect intercepted payment data.

🌍 Country ["[Unknown]"]

Associated Operations

2020-11 Group-IB experts discovered a new wave of UltraRank attacks. https://www.group-ib.com/blog/ultrarank

Introduction

(Group-IB) In August 2020, Group-IB published the report ‘UltraRank: the unexpected twist of a JS-sniffer triple threat’. The report described the operations of the cybercriminal group UltraRank, which in five years of activity had successfully attacked 691 eCommerce stores and 13 website service providers. In November 2020, Group-IB experts discovered a new wave of UltraRank attacks. Even though new attacks were detected at the time, part of the group’s infrastructure remained active and some sites were still infected. The cybercriminals did not use existing domains for new attacks but switched to a new infrastructure to store malicious code and collect intercepted payment data.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2020-11
  • Group-IB experts discovered a new wave of UltraRank attacks.
  • https://www.group-ib.com/blog/ultrarank

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • SnifLite
  • SnifLite:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.