Three Suspects Arrested in Operation Targeting GetBilling Sniffer Attacks on 200 E-Commerce Sites
Summary
A 2019 operation involving Indonesian Cyber Police, INTERPOL and Group-IB led to three arrests over GetBilling JS-sniffer attacks that compromised nearly 200 e-commerce sites and stole shoppers’ payment and personal data.
Key points
- GetBilling scripts were injected into compromised e-commerce websites to capture information entered into online forms, including payment details and login credentials.
- Nearly 200 websites across Indonesia, Australia, the UK, the US, Germany and Brazil were reportedly infected, exposing thousands of shoppers’ data.
- Suspects used VPNs to access servers used to control the sniffers and collect stolen data; they also used stolen cards to pay for hosting and domains.
- Stolen card data was used to buy high-value goods, which were resold at lower prices.
- Three suspects were arrested in Indonesia in December 2019 in a joint operation involving Indonesian Cyber Police, INTERPOL and Group-IB.
- Police seized laptops, phones, computer units, identity documents, banking tokens and ATM cards. The suspects faced charges related to electronic-data theft.
Article Details
- Event Type
- Multi-jurisdictional law-enforcement operation and arrests targeting operators of the GetBilling JS-sniffer family.
- Impact
- GetBilling compromised nearly 200 e-commerce websites across Indonesia, Australia, the United Kingdom, the United States, Germany, and Brazil, stealing payment and personal data from thousands of shoppers. The operation led to three suspects being arrested in Indonesia in December 2019 and was reported to have ended the GetBilling criminal network and its fraud activity.
People
Malware
Vendors
Countries
Australia200 e-commerce sites across Indonesia, Australia, the United Kingdom, the United States, Germany, and Brazil were compromised using GetBilling.Brazil200 e-commerce sites across Indonesia, Australia, the United Kingdom, the United States, Germany, and Brazil were compromised using GetBilling.Germany200 e-commerce sites across Indonesia, Australia, the United Kingdom, the United States, Germany, and Brazil were compromised using GetBilling.Indonesia200 e-commerce sites across Indonesia, Australia, the United Kingdom, the United States, Germany, and Brazil were compromised using GetBilling.United Kingdom200 e-commerce sites across Indonesia, Australia, the United Kingdom, the United States, Germany, and Brazil were compromised using GetBilling.United States200 e-commerce sites across Indonesia, Australia, the United Kingdom, the United States, Germany, and Brazil were compromised using GetBilling.