{
  "name": "The Mongolian Skimmer: different clothes, equally dangerous",
  "slug": "the-mongolian-skimmer-different-clothes-equally-dangerous",
  "description": "This report details the analysis of a skimming campaign, dubbed the 'Mongolian Skimmer,' which utilizes an obfuscation technique involving unusual Unicode characters for variable and function names. While initially appearing as a novel obfuscation approach, it ultimately employs well-known JavaScript capabilities. The skimmer follows typical patterns, including DOM monitoring, data exfiltration, anti-debugging measures, and cross-browser compatibility. An intriguing aspect is the discovery of a conversation between threat actors through code comments, where they agreed to split profits from the skimming operation.",
  "published": "2024-10-14T08:54:35+00:00",
  "created_at": "2024-10-14T08:54:35+00:00",
  "modified_at": "2024-10-14T09:14:59+00:00",
  "created_at_opencti": "2024-10-14T08:54:35+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-10-14",
    "cybercrime",
    "malicious",
    "obfuscation",
    "skimming",
    "underground"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "82.197.83.29"
      },
      {
        "id": "",
        "name": "82.180.138.247"
      },
      {
        "id": "",
        "name": "198.187.29.127"
      },
      {
        "id": "",
        "name": "217.21.77.96"
      },
      {
        "id": "",
        "name": "191.96.56.171"
      },
      {
        "id": "",
        "name": "widget.useonline.org"
      },
      {
        "id": "",
        "name": "widget.statictool.com"
      },
      {
        "id": "",
        "name": "process.services.bz"
      },
      {
        "id": "",
        "name": "stat.mystatpal.com"
      },
      {
        "id": "",
        "name": "mdn.safecontentdelivery.com"
      },
      {
        "id": "",
        "name": "cache.cdn-core.com"
      },
      {
        "id": "",
        "name": "common.gifcache.com"
      },
      {
        "id": "",
        "name": "seomgr.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "64e548d5-24de-4894-9c90-c6e17b3b3bee",
        "name": "T1056.002"
      },
      {
        "id": "4bbdf41c-817c-448a-9513-aaea6bfbe8b4",
        "name": "T1568"
      },
      {
        "id": "5c67e5d2-bc85-4ce0-822d-f2f5d3b0ae4e",
        "name": "T1185"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "b9a3b4f8-b9c0-4ed8-bf5e-bf759b9804d6",
        "name": "T1564"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://jscrambler.com/blog/the-mongolian-skimmer",
    "https://otx.alienvault.com/pulse/670cf86bb8e0916928b9f49d"
  ]
}