ScreamedJungleThreat actor
ScreamedJungle is a threat actor that exploits vulnerabilities in outdated Magento e-commerce platforms to inject malicious JavaScript code, specifically Bablosoft JS, into compromised websites. This actor has harvested millions of browser fingerprints by leveraging vulnerabilities such as CVE-2024-34102 and CVE-2024-20720.From MISP Galaxy
Last reported 20 months ago, by Group-IB1 report
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1036.012Browser Fingerprint
“Fingerprint Heists: How your browser fingerprint can be stolen and used by fraudsters”
- T1059Command and Scripting Interpreter
“T1059.007 Command and Scripting Interpreter: JavaScript”
- T1059.007JavaScript
“T1059.007 Command and Scripting Interpreter: JavaScript”
- T1110.004Credential Stuffing
“Bablosoft develops automation tools often linked to cybercriminals activities such as credential stuffing, fraud schemes, and data harvesting.”
- T1119Automated Collection
“T1119 Automated Collection”
- T1176.001Browser Extensions
“Use trusted and reliable browser extensions aimed at blocking the execution of suspicious javascript and detection of tracking techniques;”
What the reports say
1 report, newest first · the exact sentence from each-
Fingerprint Heists: How your browser fingerprint can be stolen and used by fraudsters“In this campaign, a threat actor, now tracked as ScreamedJungle, injected a Bablosoft JS script into compromised Magento websites to collect fingerprints of visiting users.”
Indicators in its reports
named in the reports above- hxxps://busz[.]io/j9z3GfPd?pr=1&sub_id_2=in 1 report
- busz[.]ioin 1 report
- hxxps://busz[.]io/clientsafe.jsin 1 report
- hxxps://customfingerprints.bablosoft[.]com/savein 1 report
- customfingerprints.bablosoft[.]comin 1 report
- browserleaks[.]comin 1 report
- hxxps://busz[.]io/j9z3GfPd?pr=1in 1 report
- hxxps://screamedjungle[.]com/mjzNTg?pr=1in 1 report
- screamedjungle[.]comin 1 report
- hxxps://screamedjungle[.]com/clientsafe.jsin 1 report
- dcc1122bcf60d91a…f4647b2daecain 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.