APT GroupSOCRadar source-of-truth import; pending cross-source consensus confidence

MageCart

MageCart is an umbrella term encompassing a fluid collective of distinct cybercriminal groups that specialize in web-skimming attacks, also known as digital skimming or formjacking. These groups illicitly obtain payment card information and other personally identifiable data from online shoppers by injecting malicious JavaScript code into compromised e-commerce checkout pages. The phenomenon emerged prominently around 2014-2015, initially targeting the Magento e-commerce platform, which inspired its name. MageCart's primary motivation is financial gain, achieved by selling stolen payment data on dark web marketplaces or using it for fraudulent transactions. What sets MageCart apart is its focus on client-side attacks, where malicious code executes within the user's browser, enabling real-time data theft directly from online forms. This method often bypasses traditional server-side security measures, making detection challenging. While the term MageCart originated from attacks on Magento, it has evolved to broadly describe this specific attack technique, irrespective of the underlying e-commerce platform.

Directory Briefing

Top 10 Talking Points

MageCart should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to Exploit Public-Facing Application and Valid Accounts; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

The retained sequence includes Brute Force, which supports scoping beyond the initially affected host.

Identity compromise is a central scoping issue.^1,2

Evidence includes Brute Force; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

Persistence matters more than the first payload.^1,2

Retained persistence behavior includes Boot or Logon Autostart Execution; removing malware without closing those access paths can leave the actor operational.

Legitimate administration tools may carry much of the attack.^1,2

Reported tooling or behavior includes Command and Scripting Interpreter, JavaScript, and PowerShell; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.^1,2

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.^1,2

The retained record includes Exfiltration Over C2 Channel, making repository, email, cloud, and egress review central to impact assessment.

Victimology is broad enough that sector alone is weak negative evidence.¹

Retained targeting includes Energy & Utilities, Manufacturing, Retail, HealthCare & Social Assistance, and Chemical&Pharmaceutical Manufacturing across Brazil, France, and United States; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should separate containment confidence from attribution confidence.^1,2

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Bottom Line Up Front

BLUF

MageCart should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to Exploit Public-Facing Application and Valid Accounts; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

The retained sequence includes Brute Force, which supports scoping beyond the initially affected host.

Identity compromise is a central scoping issue.^1,2

Evidence includes Brute Force; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

Persistence matters more than the first payload.^1,2

Retained persistence behavior includes Boot or Logon Autostart Execution; removing malware without closing those access paths can leave the actor operational.

Legitimate administration tools may carry much of the attack.^1,2

Reported tooling or behavior includes Command and Scripting Interpreter, JavaScript, and PowerShell; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.^1,2

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.^1,2

The retained record includes Exfiltration Over C2 Channel, making repository, email, cloud, and egress review central to impact assessment.

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type^1,2

APT Group profile

First Seen^1,2

2014-01-01

Last Seen^1,2

2026-01-13

Origin^1,2

Motivation^1,2

Financial gain,Financial crime

Primary Access Pattern^1,2

T1033

Objective^1,2

Financial gain,Financial crime

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases^1,2

ATK88Camouflage TempestG0037GOLD FRANKLINITG08FIN6SKELETON SPIDERStorm-0538TA4557TAALWhite Giant

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

BrazilFranceUnited States

Target Sectors¹

Energy & UtilitiesManufacturingRetailHealthCare & Social AssistanceChemical&Pharmaceutical ManufacturingComputer Systems Design and Related ServicesOffices of Certified Public AccountantsFinanceInternet PublishingBusiness Schools and Computer and Management TrainingPerforming Arts CompaniesSpectator SportsPromoters of Performing Arts, Sports, and Similar EventsMedical Equipment and Supplies ManufacturingOffice Supplies and Stationery StoresData Processing, Hosting, and Related ServicesAdvertising AgenciesCouriers and Express Delivery ServicesComputer Systems Design Services

Associated Activity^1,2

Initial Compromise/Injection: Presence of unfamiliar or suspicious JavaScript code, especially in checkout or payment pages.Exfiltration: Abnormal HTTP requests or unusual external domain connections attempting to send form data to untrusted origins.Persistence/Tampering: Suspicious changes in website code, particularly within scripts loaded on critical pages, or the injection of new fields into online forms.Obfuscation/Evasion: Dynamic loading of obfuscated malicious code in users' browsers, or scripts attempting to detect virtual machine environments.Client-Side Monitoring: Detection of unauthorized Personally Identifiable Information (PII) access or data exfiltration events by client-side security solutions.Infrastructural Abuses: Compromised legitimate websites acting as temporary command and control (C2) servers for skimmer delivery, or the use of broken image error events (onerror) to trigger malicious JavaScript.

ATT&CK IDs^1,2

T1033T1041 - Exfiltration Over C2 ChannelT1003.003T1213.006T1583.006 - Web ServicesT1140T1071.001T1005T1547 - Boot or Logon Autostart ExecutionT1083T1070T1055T1046T1503T1053.005T1556T1036.005 - Match Legitimate Name or LocationT1078T1546T1136T1555T1566.001T1070.004T1140 - Deobfuscate/Decode Files or InformationT1588.002T1056.003 - Web Portal CaptureT1204T1218T1572T1553.002T1189 - Drive-by CompromiseTA0037T1037T1190T1204.001 - Malicious LinkT1027.010T1059 - Command and Scripting InterpreterT1105 - Ingress Tool TransferT1505.003T1574 - Hijack Execution FlowT1036T1569T1057T1059.007 - JavaScriptT1059.007T1012T1505T1055 - Process InjectionT1110.002T1204 - User ExecutionT1102T1204.002T1685T1134.001T1021T1587T1192T1123T1102.002 - Bidirectional CommunicationT1119T1049T1041T1059.001T1110T1090T1016T1569.002T1560T1059.001 - PowerShellT1048T1047T1053T1113T1555.003T1059.003T1027 - Obfuscated Files or InformationT1082T1074.002T1018T1592.002 - SoftwareT1566T1547.001T1068T1562 - Impair DefensesT1123 - Audio CaptureT1195.002T1573T1095T1090 - ProxyT1588T1573.002TA0011T1134T1132T1087T1087.002T1056T1547T1071T1195T1114T1583.005T1104T1003.001T1027T1574T1562T1560.003T1496T1566.003T1102.003 - One-Way CommunicationT1110 - Brute ForceT1213T1106T1056.002 - GUI Input CaptureT1003T1564T1059T1036.004T1071.001 - Web ProtocolsT1553T1048.003T1074T1070.004 - File DeletionT1120T1021.001T1190 - Exploit Public-Facing ApplicationT1078 - Valid Accounts

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported 2396¹IntelliOS retained 34^2,3,4

SOCRadar reports 2396 IOCs for this profile. IntelliOS currently retains 34 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 4 source groups tracked; 3 currently contribute retained observable or context rows.

Retained Observables

Showing 34 of 34

Type	Value	Source
Tool / Process	Client-side payment-card skimmer⁴	Silent Push
Tool / Process	Magecart / web skimmer JavaScript³	Malpedia
Tool / Process	Malicious JavaScript used to steal payment card data from e-commerce sites²	MITRE
Tool / Process	Metasploit used by FIN6 for named-pipe impersonation and PowerShell modules²	MITRE
Tool / Process	Obfuscated JavaScript injector⁴	Silent Push
Tool / Process	Stealer One credential stealer²	MITRE
ATT&CK ID	T1005 - Data from Local System / payment-card data collection²	MITRE
ATT&CK ID	T1027 - Obfuscated Files or Information⁴	Silent Push
ATT&CK ID	T1041 - Exfiltration Over C2 Channel²	MITRE
ATT&CK ID	T1059 - Command and Scripting Interpreter²	MITRE
ATT&CK ID	T1059.007 - JavaScript/JScript⁴	Silent Push
ATT&CK ID	T1119 - Automated Collection²	MITRE
ATT&CK ID	T1189 - Drive-by Compromise / compromised e-commerce page execution context⁴	Silent Push
ATT&CK ID	T1195 - Supply Chain Compromise / third-party script or website compromise context⁴	Silent Push
ATT&CK ID	T1555 - Credentials from Password Stores²	MITRE
Network Indicator	cdn-cookie[.]com⁴	Silent Push
Network Indicator	colunexshop[.]com⁴	Silent Push
Campaign Context	IntelliOS keeps Magento, WooCommerce, Google Tag Manager, FIN6, Storm/Camouflage-style names, and individual web-skimmer campaigns source-scoped until specific source evidence supports a merge.³	Malpedia
Campaign Context	Malpedia's MageCart/js.magecart relationship is retained for malware-family context and source reconciliation.³	Malpedia
Campaign Context	MITRE FIN6/G0037 rows are retained as a source-backed overlap for Magecart Group 6, not proof that all Magecart-style skimming belongs to FIN6.²	MITRE
Campaign Context	Silent Push's 2026 reporting is retained for current web-skimmer infrastructure and umbrella-label explanation.⁴	Silent Push
Campaign Context	SOCRadar MageCart remains the baseline card, but IntelliOS treats Magecart as a web-skimming ecosystem and umbrella label rather than a single monolithic operator.⁴	Silent Push
OBSERVABLE	Malpedia frames Magecart as web-based card-skimmer activity tracked by RiskIQ since 2016 and retains js.magecart as the related malware-family entry.³	Malpedia
OBSERVABLE	MITRE describes FIN6 as a cybercrime group that stole payment-card data and sold it for profit, aggressively targeting PoS systems in hospitality and retail.²	MITRE
OBSERVABLE	MITRE tracks FIN6 / G0037 with associated names including Magecart Group 6, ITG08, Skeleton Spider, TAAL, and Camouflage Tempest.²	MITRE
OBSERVABLE	Silent Push explains that Magecart has evolved from specific Magento-focused groups into an umbrella term for client-side web-skimming and formjacking attacks.⁴	Silent Push
OBSERVABLE	Silent Push reports a long-running Magecart web-skimmer campaign active since approximately 2022 and targeting payment networks including American Express, Diners Club, Discover, JCB, Mastercard, and UnionPay.⁴	Silent Push
OBSERVABLE	Web skimmers execute in the user's browser during checkout and can be difficult for site owners or users to observe directly.⁴	Silent Push
SECTOR	E-commerce stores and checkout flows⁴	Silent Push
SECTOR	Global payment networks and their enterprise customers⁴	Silent Push
SECTOR	Hospitality²	MITRE
SECTOR	Magento / Adobe Commerce ecosystems³	Malpedia
SECTOR	Retail²	MITRE
SECTOR	WooCommerce and other web-commerce platforms³	Malpedia

Source	Reported	Retained	Coverage Status
SOCRadar¹	2396	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.
MITRE ATT&CK²	N/A	13	Public observables or source-context rows retained and displayed.
Malpedia³	N/A	6	Public observables or source-context rows retained and displayed.
Silent Push⁴	N/A	15	Public observables or source-context rows retained and displayed.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

Flash Threat Intel Brief

Magecart / Magento Payment Skimming

Exact related IntelliOS product link retained from /vault/magecart-magento-payment-skimming.

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	MageCart	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	MageCart	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for MageCart.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Threat actor directory source for profile fields and reported activity.
2	MITRE ATT&CK https://attack.mitre.org/groups/G0037/	ATT&CK source for group, campaign, software, alias, and technique mappings where matched.
3	Malpedia: MageCart https://malpedia.caad.fkie.fraunhofer.de/actor/magecart	Actor Encyclopedia
4	Silent Push: Magecart web-skimmer network https://www.silentpush.com/blog/magecart/	Threat Research

Loading Threat Actor Cards

MageCart

Top 10 Talking Points

MageCart should be treated as an intrusion cluster, not a single immutable toolkit.1,2

Initial access should be scoped across identity and Internet-facing systems.1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1,2

Identity compromise is a central scoping issue.1,2

Persistence matters more than the first payload.1,2

Legitimate administration tools may carry much of the attack.1,2

The actor may reduce visibility before the main objective is reached.1,2

Collection and exfiltration reveal the likely mission.1,2

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1,2

BLUF

MageCart should be treated as an intrusion cluster, not a single immutable toolkit.1,2

Initial access should be scoped across identity and Internet-facing systems.1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1,2

Identity compromise is a central scoping issue.1,2

Persistence matters more than the first payload.1,2

Legitimate administration tools may carry much of the attack.1,2

The actor may reduce visibility before the main objective is reached.1,2

Collection and exfiltration reveal the likely mission.1,2

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1,2

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

Magecart / Magento Payment Skimming

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

MageCart should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Initial access should be scoped across identity and Internet-facing systems.^1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2

MageCart should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Initial access should be scoped across identity and Internet-facing systems.^1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2