• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Dexphot – A Polymorphic Threat
December 4, 2019
Rewterz Threat Advisory – CVE-2019-18245 – ICS: Reliable Controls LicenseManager
December 4, 2019

Rewterz Threat Alert – Magecart Attacks Hacking Websites to Steal Customer Payment Info

December 4, 2019

Severity

Medium

Analysis Summary

In MageCart attacks, hackers are compromising web sites so that they can inject malicious JavaScript scripts into ecommerce or checkout pages. These scripts then steal payment information that is submitted by a customer by sending it to a remote site under the attacker’s control. This time, though, the script injected into smith-wesson.com is coming from the URL live.sequracdn[.]net/storage/modrrnize.js as shown below.

Magecart script loading on smith-wesson.com

This script is not easy to spot as it will load a non-malicious or malicious script depending on the visitor and section of the site being visited. For most of the site, the loaded JavaScript file looks like a normal 11KB and non-malicious script. However if you are using a US-based IP address, non-Linux browsers, not on the AWS platform, and at the checkout page, the script being delivered changes from 11KB to 20KB, with the Magecart portion appended to the bottom. When this script is loaded, during checkout a fake payment form will be shown. If a customer enters their payment information in this form and submits it, the payment information will first be sent to https://live.sequracdn.net/t/, which is a server that belongs to the attackers. The attackers can then log into their server and retrieve the stolen payment information.

Impact

  • Theft of credit card information
  • Financial loss

Indicators of Compromise

Domain Name

sanguinelab[.]net

URL

http[:]//live.sequracdn[.]net/storage/modrrnize[.]js

Remediation

  • Block the threat indicators at their respective controls.
  • Keep websites patched against exploitable vulnerabilities.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.