Hacking group FIN6 changes tactics and aims at e-commerce websites

Card-skimming code injected into online checkout pages of retailers

Hacking on keyboard

Hackers have been discovered injecting malware into compromised e-commerce websites that steal payment card data from unsuspecting victims.

According to a blog post by security researchers at IBM X-Force Incident Response and Intelligence Services (IRIS), FIN6 (a.k.a. ITG08) is better known for targeting point of sale (PoS) terminals in Europe and the US but lately has changed tactics.

It a new campaign, hackers have been found injecting malicious code into online checkout pages of compromised websites a technique known as online skimming thereby stealing payment card data transmitted to the vendor by unsuspecting customers.

Advertisement - Article continues below

Researchers said that the cyber criminal gang has been actively attacking multinational organisations, targeting specific employees with spear-phishing emails advertising fake job advertisements and repeatedly deploying the More_eggs JScript backdoor malware (aka Terra Loader, SpicyOmelette).

They added that this backdoor has been sold on the dark web by an underground malware as a service (MaaS) provider.

The gang are also used common tactics from earlier campaigns, such as Windows Management Instrumentation (WMI) to automate the remote execution of PowerShell scripts, PowerShell commands with base64 encoding, and Metasploit and PowerShell to move laterally and deploy malware.

They have also used Comodo code-signing certificates several times during the course of the campaign.

Advertisement
Advertisement - Article continues below

To gain entry into an organisation's infrastructure, the gang targeted employees via LinkedIn messaging and email, advertising fake jobs.

"In one case, we uncovered evidence indicating that the attacker had established communication with a victim via email and convinced them to click on a Google Drive URL purporting to contain an attractive job advert," researchers said.

Advertisement - Article continues below

"Once clicked, the URL displayed the message, Online preview is not available,' then presented a second URL leading to a compromised or rogue domain, where the victim could download the payload under the guise of a job description."

That URL, in turn, downloaded a ZIP file containing a malicious Windows Script File (WSF) that initiated the infection routine of the More_eggs backdoor.

Once in, hackers then used WMI and PowerShell techniques to perform network reconnaissance and move laterally within the environment.

"The attackers used this technique to remotely install a Metasploit reverse TCP stager on select systems, subsequently spawning a Meterpreter session and Mimikatz," said researchers.

Mimikatz is a post-exploitation tool that allows attackers to steal credentials.

"Stolen credentials are usually leveraged to facilitate privilege-escalation and further lateral movement through the compromised environment," said researchers.

The hackers then planted backdoors on several other devices to enable the hackers to find more ways into a victim's network.

Researchers said that the gang has been around for four years: "Its attacks are financially motivated, sophisticated and persistent. The group historically has specialized in stealing payment card data from POS machines and has more recently expanded operations to target card-not-present data from online transactions."

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/cyber-security/355185/165-million-britons-experienced-a-cyber-crime-in-the-past-year
cyber security

Report: 16.5 million Britons fell victim to cyber crime in the past year

1 Apr 2020
Visit/cloud/amazon-web-services-aws/355183/aws-launches-amazon-detective
Amazon Web Services (AWS)

AWS launches Amazon Detective for investigating security incidents

1 Apr 2020
Visit/security/privacy/355182/government-to-launch-coronavirus-contact-tracking-app
privacy

UK government to launch coronavirus 'contact tracking' app

1 Apr 2020
Visit/software/video-conferencing/355180/zoom-does-not-use-end-to-end-encrypted
video conferencing

Zoom admits meetings don't use end-to-end encryption

1 Apr 2020

Most Popular

Visit/security/cyber-crime/355171/fbi-warns-of-zoom-bombing-hackers-amidst-coronavirus-usage-spike
cyber crime

FBI warns of ‘Zoom-bombing’ hackers amid coronavirus usage spike

31 Mar 2020
Visit/security/data-breaches/355173/marriott-hit-by-data-breach-exposing-personal-data-of-52-million
data breaches

Marriott data breach exposes personal data of 5.2 million guests

31 Mar 2020
Visit/data-insights/data-management/355170/oracle-cloud-courses-are-free-during-coronavirus-lockdown
data management

Oracle cloud courses are free during coronavirus lockdown

31 Mar 2020
Visit/software/business-apps/355178/ibm-call-for-code-starter-kits-target-coronavirus-solutions
business apps

IBM Call for Code starter kits focus on coronavirus solutions

31 Mar 2020