Key findings from new report released today by Gemini Advisory researchers:
They also provide appendices:
Appendix A: List of 64 unique Keeper attacker domains: https://geminiadvisory.io/wp-content/uploads/2020/07/Appendix-A-3.pdf
Appendix B: List of 73 exfiltration domains that Keeper used to extract stolen payment card data: https://geminiadvisory.io/wp-content/uploads/2020/07/Appendix-B-1.pdf
Appendix C: List of 570 compromised victim domains infected by Keeper: https://geminiadvisory.io/wp-content/uploads/2020/07/Appendix-C-1.pdf
.
- Gemini discovered that the “Keeper” Magecart group, which consists of an interconnected network of 64 attacker domains and 73 exfiltration domains, has targeted over 570 victim e-commerce sites in 55 different countries from April 1, 2017 until the present. The Keeper exfiltration and attacker domains use identical login panels and are linked to the same dedicated server; this server hosts both the malicious payload and the exfiltrated data stolen from victim sites.
- Over 85% of the victim sites operated on the Magento CMS, which is known to be the top target for Magecart attacks and boasts over 250,000 users worldwide. The country hosting the largest selection of these victim e-commerce sites was the United States, followed by the United Kingdom and the Netherlands.
- Gemini uncovered an unsecured access log on the Keeper control panel with 184,000 compromised cards with time stamps ranging from July 2018 to April 2019. Extrapolating the number of cards per nine months to Keeper's overall lifespan, and given the dark web median price of $ 10 per compromised Card Not Present (CNP) card, this group has likely generated upwards of $ 7 million USD from selling compromised payment cards.
- The Keeper Magecart group has been active for three years, over which time it has continually improved its technical sophistication and the scale of its operations. Based on this pattern of successful Magecart attacks, Gemini assesses with high confidence that Keeper is likely to continue launching increasingly sophisticated attacks against online merchants across the world.
They also provide appendices:
Appendix A: List of 64 unique Keeper attacker domains: https://geminiadvisory.io/wp-content/uploads/2020/07/Appendix-A-3.pdf
Appendix B: List of 73 exfiltration domains that Keeper used to extract stolen payment card data: https://geminiadvisory.io/wp-content/uploads/2020/07/Appendix-B-1.pdf
Appendix C: List of 570 compromised victim domains infected by Keeper: https://geminiadvisory.io/wp-content/uploads/2020/07/Appendix-C-1.pdf
.
