The website of Smith & Wesson was targeted by digital skimmers last week as they planted malicious code designed to steal customer payment card information. 

According to Sanguine Security, the attackers planted a payment skimmer on the Smith & Wesson online store on Wednesday, November 27, during the busy Black Friday holiday shopping weekend. The firm claims that as of Monday, December 2 that the skimming code is still active. The skimmer captures the personal and financial information entered by customers on the checkout page and sends the information to the attackers. 

Strangely, the attackers have been using the Sanguine Security name as cover to legitimize the campaign. The security vendors forensic expert, Willem de Groot, claims, "Skimming code & infrastructure is identical to the campaign that impersonates Sanguine Security."

The attackers likely chose Sanguine Security deliberately, as much of their work is to protect customers from Magecart-style attacks. 

This attack looks to be the work of one of the several hacker groups specializing in Magecart attacks, which require credit card skimmers to be planted on the online stores or through companies providing services to online shops. 

It's suggested that the attackers exploited a known security vulnerability within the Magento eCommerce platform to hack the Smith & Wesson website. Magento recently warned its customers to install patches for a remote code execution vulnerability that can be exploited by unauthenticated users to deliver malware. 

As of today, the malicious code is still present on the organization's website. 

Smith & Wesson website hacked

Macy's customers also recently had their payment details compromised due to Magecart code that compromised parts of their website. 

To defend against this style of attack, organizations must implement security best practices and adopt the essential CIS Controls, which suggests implementing solutions like File Integrity Monitoring. Conducting FIM to detect and audit changes to key web application source code could be used to detect these kinds of breaches.  






The Most Powerful & Reliable Cybersecurity Products

change tracker gen7r2 logo

Change Tracker Gen 7R2: Complete configuration and system integrity assurance combined with the most comprehensive and intelligent change control solution available.

FAST Cloud logo

Fast Cloud: Leverage the world’s largest whitelist repository to automatically evaluate and verify the authenticity of file changes in real-time with NNT FAST™ (File Approved-Safe Technology)

vulnerability tracker logo

Vulnerability Tracker: The world’s only limitless and unrestricted vulnerability scanning solution with unparalleled accuracy and efficiency, protecting your IT assets on premises, in the cloud and mobile endpoints.

log tracker logo

Log Tracker: Comprehensive and easy to use security information & event log management with intelligent & self-learning correlation technology to highlight potentially harmful activity in seconds

Contact Us

Corporate Headquarters

6160 Warren Parkway, Suite 100
Frisco, Texas, 75034

Phone 1: 1-949-407-5125

Phone 2: 888-638-9749 (toll-free)

[email protected]

United Kingdom

5 New Street Square
London EC4A 3TW

Phone: +44 (0) 203 588 3023

 [email protected]
SC Magazine Cybersecurity 500 CSGEA Winners 2021 CIS benchmarking SEWP Now Certified IBM Security
Copyright 2024, New Net Technologies LLC. All rights reserved. 
NNT and Change Tracker are registered trademarks of New Net Technologies LLC.
All other product, company names and trademarks are the property of their respective owners.