Silent Skimmer, a sophisticated Chinese-speaking threat actor, has recently expanded its credit card skimming campaign beyond the Asia/Pacific region, targeting ecommerce sites in North and Latin America. This expansion points to the evolving tactics and global reach of cybercriminals. The threat actor has been gaining unauthorized access to a wide range of websites across multiple industry sectors by exploiting vulnerabilities in web applications, similar to tactics previously employed by the notorious Hafnium group involved in cyber espionage campaigns.
Exploitation of vulnerabilities
Silent Skimmer’s success in breaching targeted websites lies in its ability to exploit vulnerabilities in web applications. The threat actor has demonstrated adeptness in finding and utilizing these vulnerabilities, including one notable exploit used by the Hafnium group. By leveraging these vulnerabilities, Silent Skimmer gains unauthorized access to websites, bypassing security measures set in place by unsuspecting organizations.
Goal of Attacks
The primary goal of Silent Skimmer’s attacks is to gain access to payment pages on targeted e-commerce sites. Once within these payment pages, the threat actor drops malware carefully designed to steal credit card numbers from online shoppers. By successfully compromising these sensitive payment pages, Silent Skimmer gains access to a wealth of valuable financial data that can be used for fraudulent activities.
Silent Skimmer Campaign
The ongoing campaign orchestrated by Silent Skimmer has been aptly named “Silent Skimmer” by security researchers at BlackBerry. This naming reflects both the technical complexity of the campaign and the potential involvement of an advanced threat actor. The meticulous execution and sophisticated tactics employed by Silent Skimmer indicate that this is not your typical run-of-the-mill cybercriminal operation.
History of Magecart
Silent Skimmer’s campaign aligns with the recent modus operandi of Magecart, a loose collection of hacking groups notorious for stealing payment card data from millions of online shoppers worldwide. Magecart has been a persistent threat, exploiting vulnerabilities in website infrastructure to carry out their skimming activities. The expansion of Silent Skimmer’s operations is just another chapter in the long-standing legacy of Magecart’s illicit endeavors.
Exploited vulnerabilities
Silent Skimmer has specifically targeted websites hosted on Microsoft’s Internet Information Services (IIS) Web server software. Among the vulnerabilities exploited, one particularly concerning vulnerability is CVE-2019-18935. This critical remote code execution flaw in Telerik UI has also been utilized by other threat groups like Hafnium and Vietnam’s XE Group. The exploitation of shared vulnerabilities across multiple threat actors demonstrates the need for organizations to promptly address and patch these vulnerabilities to protect their systems and customers.
Tools and techniques
To carry out their operations, Silent Skimmer employs a series of sophisticated tools and techniques. The threat actor utilizes a wide array of tools for privilege escalation, remote access, remote code execution exploits, malware staging and downloading, as well as post-exploit activities. Remarkably, Silent Skimmer heavily relies on legitimate open-source tools, binaries, and scripts, further complicating the detection and attribution of their activities.
Command-and-Control Infrastructure
Silent Skimmer demonstrates an adaptive nature when it comes to their command-and-control (C2) infrastructure. The threat actor adjusts their C2 infrastructure based on the geolocation of their victims, deploying virtual private servers (VPS) as C2 servers. By using VPS hosted in the same region or country as the victim, Silent Skimmer blends their malicious traffic with legitimate traffic, making it harder to identify and mitigate their presence.
Impact and consequences
The repercussions of Silent Skimmer’s credit card skimming campaign are profound. For affected e-commerce sites, the breach of their payment pages can result in reputational damage, financial loss, and potential regulatory consequences. Additionally, online shoppers who have fallen victim to Silent Skimmer may face financial fraud and unauthorized use of their credit card information. Financial institutions also bear the burden of potential losses and increased efforts to combat fraud.
The expansion of Silent Skimmer’s credit card skimming campaign highlights the ever-present threat posed to e-commerce websites globally. The increasing complexity and adaptability of threat actors like Silent Skimmer necessitate heightened awareness and cybersecurity measures. Organizations should prioritize the timely patching of web application vulnerabilities, implement robust security protocols, and continuously monitor and detect any signs of compromise to protect their customers’ sensitive information. Collaboration between businesses, security researchers, and law enforcement agencies is crucial in combating the persistent and evolving threat of credit card skimming attacks.