Description of Campaign
Popular platforms such as Magento, PrestaShop, and WordPress are typical targets of data-stealing web skimmers. Initial access is carried out by supply chain and brute force attacks, as well as by taking advantage of vulnerabilities and misconfigurations. Successful infections result in skimming code stealing personal data, credit card information, and passwords.

Our Threat Research team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by Microsoft and shared publicly.

How to use this article:

1. If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign. 
2. Review the product detection table and confirm that your environment is at least on the specified content version.
   To download the latest content versions, go to the Security Updates page.
3. Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
4. Review KB91836 - Countermeasures for entry vector threats.
5. Review KB87843 - Dynamic Application Containment rules and best practices.
6. Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

This Knowledge Base article discusses a specific threat that's being tracked. The list of IOCs will change over time; check Trellix Insights for the latest IOCs.
 
Campaign IOC

Type	Value
SHA256	88E9D5EDDD24546AB78CE8DB1EB474A20B9694F52D4C7AD976FBFA683B7CE635
SHA256	B397E7AD2D00DCEF4CF4BA5DF363684B1FEFCC64C23AB110032A7B2EBB77AB4A
SHA256	A6FC14A7BB5E05C1D271ADD5B38744523FED01A18CE5578B965EE02E19589E77
URL	https://45.197.141.250/statystics.php
URL	https://45.197.141.250/analytics.php
URL	https://apiujquery.com/ajax/libs/jquery/3.5.1/jquery-3.11.0.min.js?i=
URL	trafficapps.business/data.php?p=form
URL	https://jqueridev.at/jquery.ba-hashchange.min.js
URL	https://jquerystatic.xyz/jquery-static.js
URL	https://sotech.fun/identity.js
URL	https://techlok.bar/scevent.min.js
URL	https://dratserv.bar/script-min-2.5.4.min.js
URL	https://idtransfer.icu/www.google-analytics.com/aromaonlinestore.com.js
URL	trafficapps.org/data.php?p=f16i13
URL	https://cilent-tracking.com/js/tracking-2.1.min.js
URL	googleservices.online/v4/api/apiV2.js
URL	lightgetjs.com/light.js
URL	jspack.pro/api.js
URL	mageento.com/v3/api/logs.js
URL	agilityscripts.com/js/safefile.js
URL	https://106.15.179.255
URL	https://103.233.11.28/jQuery_StXlFiisxCDN.php?hash=06d08a204bddfebe2858408a62c742e944824164

Minimum Content Versions

Content Type	Version
V2 DAT (VirusScan Enterprise)	10361
V3 DAT (Endpoint Security)	4813

  
Detection Summary                               

IOC	Scanner	Detection
88E9D5EDDD24546AB78CE8DB1EB474A20B9694F52D4C7AD976FBFA683B7CE635	AVEngine V2	Trojan-BankSkimmer
	AVEngine V3	Trojan-BankSkimmer
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
B397E7AD2D00DCEF4CF4BA5DF363684B1FEFCC64C23AB110032A7B2EBB77AB4A	AVEngine V2	Trojan-BankSkimmer
	AVEngine V3	Trojan-BankSkimmer
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
A6FC14A7BB5E05C1D271ADD5B38744523FED01A18CE5578B965EE02E19589E77	AVEngine V2	Trojan-BankSkimmer
	AVEngine V3	Trojan-BankSkimmer
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

Minimum set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Host Intrusion Prevention:
Aggressive set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

VirusScan Enterprise - Access Protection Rules: