The website of Smith & Wesson was targeted by digital skimmers last week as they planted malicious code designed to steal customer payment card information. 

According to Sanguine Security, the attackers planted a payment skimmer on the Smith & Wesson online store on Wednesday, November 27, during the busy Black Friday holiday shopping weekend. The firm claims that as of Monday, December 2 that the skimming code is still active. The skimmer captures the personal and financial information entered by customers on the checkout page and sends the information to the attackers. 

Strangely, the attackers have been using the Sanguine Security name as cover to legitimize the campaign. The security vendors forensic expert, Willem de Groot, claims, "Skimming code & infrastructure is identical to the campaign that impersonates Sanguine Security."

The attackers likely chose Sanguine Security deliberately, as much of their work is to protect customers from Magecart-style attacks. 

This attack looks to be the work of one of the several hacker groups specializing in Magecart attacks, which require credit card skimmers to be planted on the online stores or through companies providing services to online shops. 

It's suggested that the attackers exploited a known security vulnerability within the Magento eCommerce platform to hack the Smith & Wesson website. Magento recently warned its customers to install patches for a remote code execution vulnerability that can be exploited by unauthenticated users to deliver malware. 

As of today, the malicious code is still present on the organization's website. 

Smith & Wesson website hacked

Macy's customers also recently had their payment details compromised due to Magecart code that compromised parts of their website. 

To defend against this style of attack, organizations must implement security best practices and adopt the essential CIS Controls, which suggests implementing solutions like File Integrity Monitoring. Conducting FIM to detect and audit changes to key web application source code could be used to detect these kinds of breaches.  

 

 

 

 

 

The Most Powerful & Reliable Cybersecurity Products
Contact Us

USA Offices

New Net Technologies LLC
4850 Tamiami Trail, Suite 301
Naples, Florida, 34103

New Net Technologies LLC
1175 Peachtree St NE
Atlanta, Georgia, 30361.

Tel: (844) 898-8358
[email protected]

 

UK Office

New Net Technologies Ltd
The Russell Building, West Common
Harpenden, Hertfordshire
AL5 2JQ

Tel: 020 3917 4995
 [email protected]

SC Magazine Cybersecurity 500 CSGEA Winners 2021 CIS benchmarking SEWP Sans Institute Now Certified IBM Security
Copyright 2021, New Net Technologies LLC. All rights reserved. 
NNT and Change Tracker are registered trademarks of New Net Technologies LLC.
All other product, company names and trademarks are the property of their respective owners.