Credit Card Stealer Investigation Uncovers Malware Ring

During a recent investigation, I found a new piece of malicious code being used to steal credit card information from compromised Magento sites.

What I didn’t know was how many domains would be uncovered as part of the malware campaign. Each of the malicious domain names was specifically chosen to appear as legitimate as possible to the website owner. The hosting provider used for these domains also turned out to be used for much more.

Magento Database Injections

Let’s start with the malicious code that was injected inside the Magento database, specifically under the core_config_data table.

This was the JavaScript injected into the database:

The JavaScript is loading malware from mcloudjs[.]com

Here is some of the hex encoded malware we discovered:

Once decoded, we see that the code is looking for the payment form where users enter their credit card information. The malware then attempts to send this data to cdnpayment[.]com

We took a look at this domain to see if there was anything more we could learn about how it was being used.

Server Hosting Multiple Malicious Domains

This was the response to a DNS query for the IP address associated with the domain cdnpayment[.]com:

;; ANSWER SECTION:
cdnpayment[.]com.     27036    IN    A    185.172.110.203

We dug a bit deeper to find out where this IP address was being hosted and what else was being stored there.

Here is the range of IP addresses owned by LeaseVPS:

inetnum:     185.172.110.0 - 185.172.111.255
netname:     LeaseVPS
country:     NL

The same server with IP 185.172.110.203 appears to be home to quite a few questionable domains; some are also blacklisted by Google:

• apissystem[.]com
• codesmagento[.]com
• controlmage[.]com
• cdnppay[.]com
• resselerratings[.]com
• cdngoogle[.]com
• apismanagers[.]com
• verpayments[.]com
• myageverify[.]com
• assetsbraln[.]com
• verpayment[.]com
• magesources[.]co
• traskedlink[.]com
• magejavascripts[.]com
• mjs24[.]com
• m24js[.]com
• cdnassels[.]com
• magescripts[.]pw
• jscriptscloud[.]com

All of these domains are crafted to appear legitimate, and it seems there is a much larger campaign at play here that could have widespread impacts if the attacker is successful.

Domains4Bitcoins Used Maliciously

It looks like the original domain we found on the hacked Magento site was registered back in June of 2017, so we can assume that this campaign has been active for a few months.

   Domain Name: CDNPAYMENT[.]COM
   Registry Domain ID: 2136693814_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.PublicDomainRegistry.com
   Registrar URL: http://www.publicdomainregistry.com
   Updated Date: 2017-06-25T09:16:25Z
   Creation Date: 2017-06-24T10:30:28Z
   Registry Expiry Date: 2018-06-24T10:30:28Z

   Name Server: 1A7EA920.BITCOIN-DNS.HOSTING
   Name Server: A8332F3A.BITCOIN-DNS.HOSTING
   Name Server: AD636824.BITCOIN-DNS.HOSTING
   Name Server: C358EA2D.BITCOIN-DNS.HOSTING

Based on the name servers used by the domain, I found that the VPS was most likely purchased from domains4bitcoins [.] com. It appears that they’re offering hosting which malicious users can pay for using bitcoins. This helps attackers avoid getting caught, as the payments are not traceable.

Same Campaign on Different Domains

I did some further investigation into the other domains hosted on that server and found that you can access the same malicious code from pretty much all of them.

Here are a few examples

• hxxps://controlmage [.] com/e/tracking.js
• hxxp://assetsbraln [.] com/e/tasking.js
• hxxp://codesmagento [.] com/e/tracking.js
• hxxp://cdngoogle [.] com/e/tracking.js

The following scripts are also available on all the domains:

• /ex-payment.js
• /e/tracking.js
• /cv5/tasking.js
• /e/ms.css
• /ext/htc.css
• /hdt.js

It’s even possible to use a random script name and get the same malicious code. Here is an example:

• hxxp://controlmage[.]com/ext/really.pdf

Ransomware and Credit Card Scrapers

I also did some research on the name servers, specifically other domains using BITCOIN-DNS.HOSTING. I found that not only was the Magento malware hosted on servers provided by the same company – it looks like ransomware is also involved.

Some users reported that an email under aolonline [.] top had been used as a buyout email for the ransom. The domain aolonline [.] top used the same name servers along with a few other domains involved in other ransomware attacks like mortalkombat[.]top

Conclusion

Hackers have no problem finding hosting services for their malware and ransomware campaigns. Even if one hosting provider is taken down, in no time there would be three more to take their place.

As we approach the holidays, we expect to see a rise in attacks on ecommerce sites. Hackers are getting ready to take advantage of the increase in online shopping being done throughout the next few months.

Service providers need to be taking more steps to educate their growing audience of new website owners who expect security to be included with website hosting and development.

As a website owner, you can reduce the risks by keeping your software up to date, or by virtually patching with a website firewall. This helps close any security holes in your framework. The other piece is using good account management, including passwords and least privileged access principles. These two elements do the most to protect your website and your visitors.

In the event of an incident, integrity monitoring services and professional incident response are the best ways to ensure you can respond quickly.