RiskIQ researchers identified and internally named the group Magecart.
Explicit Confidence 98% · Jonathan Klijnsma EP 52 Details
“We had to give it a name internally to reference it and at some point, this turned into Magecart.”
Threat actor
threat_actor:magecart
Also: Magecart hacking group
Name originally assigned by RiskIQ to a group compromising Magento sites with payment-skimming JavaScript; later used for multiple related groups.
Name originally assigned by RiskIQ to a group compromising Magento sites with payment-skimming JavaScript; later used for multiple related groups.
“at some point, this turned into Magecart.”
“the team at RiskIQ called this group Magecart.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | RiskIQ | Explicit | 52 |
| outgoing | USES | web skimming | Explicit | 52 |
| outgoing | USES | supply-chain compromise | Explicit | 52 |
| outgoing | USES | JavaScript | Explicit | 52 |
| outgoing | ASSOCIATED_WITH | Magento | Explicit | 52 |
| incoming | PART_OF | Magecart Group 2 | Derived | 52 |
| incoming | PART_OF | Magecart Group 3 | Derived | 52 |
| incoming | PART_OF | Magecart Group 4 | Derived | 52 |
| incoming | ASSOCIATED_WITH | British Airways data breach | Uncertain | 52 |
| incoming | ASSOCIATED_WITH | Newegg data breach | Uncertain | 52 |
RiskIQ researchers identified and internally named the group Magecart.
Explicit Confidence 98% · Jonathan Klijnsma EP 52 Details
“We had to give it a name internally to reference it and at some point, this turned into Magecart.”
Magecart USES web skimming
Magecart uses web skimming to steal payment data from online checkout pages.
Explicit Confidence 98% · Jonathan Klijnsma EP 52 Details
“Web skimming is the go-to thing by now if you want to steal credit card data.”
Magecart USES supply-chain compromise
Magecart has used compromised third-party or supply-chain resources to place malicious JavaScript on websites.
Explicit Confidence 97% · Jack Rhysider EP 52 Details
“the hackers were getting this malicious JavaScript into these sites through the supply chain”
Magecart USES JavaScript
Magecart skimmers are implemented as small pieces of JavaScript loaded into websites.
Explicit Confidence 99% · Jonathan Klijnsma EP 52 Details
“The skimming code is a small piece of JavaScript.”
Magecart ASSOCIATED_WITH Magento
Magecart originated in activity involving websites running Magento, although the group later expanded beyond Magento.
Explicit Confidence 94% · Jack Rhysider EP 52 Details
“the Magecart hacking group initially started as a single group in 2015”
“not all these sites that are compromised are running Magento. This is just where the term is originated from”
Magecart Group 2 PART_OF Magecart
Magecart Group 2 is presented as one of the groups tracked under the broader Magecart name.
Derived Confidence 88% · Jack Rhysider EP 52 Details
“there’s Magecart hacking Group 2 and Group 3 and Group 4”
Magecart Group 3 PART_OF Magecart
Magecart Group 3 is presented as one of the groups tracked under the broader Magecart name.
Derived Confidence 88% · Jack Rhysider EP 52 Details
“there’s Magecart hacking Group 2 and Group 3 and Group 4”
Magecart Group 4 PART_OF Magecart
Magecart Group 4 is presented as one of the groups tracked under the broader Magecart name.
Derived Confidence 88% · Jack Rhysider EP 52 Details
“there’s Magecart hacking Group 2 and Group 3 and Group 4”
British Airways data breach ASSOCIATED_WITH Magecart
RiskIQ's findings suggested that the British Airways breach may have involved the same Magecart skimming group or code, but the episode does not establish this as certain.
Uncertain Confidence 86% · Jack Rhysider EP 52 Details
“he was able to take this knowledge and searched his database of cashed websites to see if this same group might be hacking another website”
“the technique that we observed so many times”
Newegg data breach ASSOCIATED_WITH Magecart
The Newegg breach was associated with the same skimming code and group observed in the British Airways incident, but the episode does not identify the perpetrators with certainty.
Uncertain Confidence 90% · Jack Rhysider EP 52 Details
“They did find the same skimming code on another website. This time, it was on the website newegg.com.”
“What happened there was it was another breach.”