Caesar Cipher Skimmer – Malware

Caesar Cipher Skimmer
Type of Malware	Infostealer
Country of Origin	Unknown
Date of initial activity	2024
Associated Groups	Unknown
Motivation	Data Theft
Attack Vectors	Supply Chain
Type of information Stolen	Financial Gain

Overview

Unlike typical credit card skimmers that rely on straightforward code injection, the Caesar Cipher Skimmer employs a classical encryption technique—the Caesar cipher—on Unicode character values. This method, rooted in ancient encryption practices, is ingeniously adapted to obscure the skimmer’s payload. By manipulating the character encoding of its malicious code, the skimmer effectively evades detection, making it a formidable challenge for cybersecurity experts. The skimmer’s deployment across various CMS platforms, including WordPress, Magento, and OpenCart, underscores its versatility and the widespread threat it poses. This malware has been observed targeting critical files and plugins within these systems, demonstrating an alarming capacity for cross-platform attacks. The use of deceptive scripts, disguised as legitimate Google Analytics and Tag Manager components, further complicates detection efforts and highlights the need for enhanced vigilance and robust security practices. As we delve deeper into the mechanics of the Caesar Cipher Skimmer, it becomes evident that understanding its operation is crucial for developing effective defenses. This article will explore the technical intricacies of this malware, including its encryption techniques and the tactics employed to evade security measures. By dissecting the Caesar Cipher Skimmer’s approach, we aim to provide valuable insights for cybersecurity professionals and website owners alike, empowering them to better protect their systems against this sophisticated threat.

Targets

Information.

How they operate

At its core, the Caesar Cipher Skimmer utilizes a modified version of the Caesar cipher, an ancient encryption technique, to obfuscate its code. Traditionally used to encode alphabetic characters, the Caesar cipher in this context is applied to Unicode character values. The malware encodes its payload by shifting the Unicode values of its characters, making the obfuscated code appear as a jumbled string of characters. This approach effectively hides the skimmer’s true intent from automated detection systems and human analysts alike. The malware’s operation begins with an injection of malicious code into critical files within the target’s content management system (CMS). For example, in WooCommerce environments, the malware often targets the form-checkout.php file, a crucial component of the checkout process. By injecting its code into this file, the skimmer captures sensitive credit card information entered by users. The injected code is designed to appear as legitimate Google Analytics or Tag Manager scripts, leveraging obfuscation techniques such as String.fromCharCode to mask its true function. Once embedded in the target website, the skimmer’s code performs a series of obfuscation steps to conceal its payload. The malicious script begins by splitting encoded strings into individual characters and then reversing their order. Subsequently, it subtracts a fixed value—typically three—from the Unicode value of each character, effectively applying the Caesar cipher. This step transforms the jumbled characters into a more recognizable format, though still encoded. The malware’s obfuscation strategy continues with the construction of a WebSocket connection to a remote server. This server sends additional layers of obfuscated JavaScript, further complicating detection and analysis. The WebSocket connection allows the skimmer to receive customized responses based on the infected site’s context, such as tailoring its actions for logged-in WordPress users. The presence of comments in the code, written in Russian, suggests that some versions of the malware may have originated from Russian-speaking developers. The Caesar Cipher Skimmer’s deployment is not limited to a single CMS. It has been identified on multiple platforms, including Magento and OpenCart, where it exploits similar vulnerabilities. In Magento, the skimmer often manipulates the core_config_data database table, while in OpenCart, the exact insertion point remains under investigation. The malware’s adaptability across different systems highlights its sophistication and the need for comprehensive security measures. To mitigate the threat posed by the Caesar Cipher Skimmer, website owners should prioritize regular updates to their CMS and plugins, strengthen admin account security, and implement file integrity monitoring and web application firewalls. By understanding the technical mechanisms of this malware, cybersecurity professionals can develop more effective defenses against this evolving threat, ensuring better protection for ecommerce environments and their sensitive data.