ThreatFox: vSkimmer IOCs

Hunt Hypothesis

This hunt targets the presence of vSkimmer indicators of compromise, a known web skimmer used by adversaries to intercept and exfiltrate sensitive payment data from compromised web applications. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential skimmer deployments early, mitigating the risk of financial fraud and data theft before attackers can successfully capture customer credentials.

IOC Summary

Malware Family: vSkimmer Total IOCs: 10 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - vSkimmer
let malicious_domains = dynamic(["trainli.com", "mbs-standoffs.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - vSkimmer
let malicious_urls = dynamic(["https://static-js.com/js/jmj.js", "https://static-js.com/js/cg.js", "https://static-js.com/js/gf.js", "https://static-js.com/js/zens.js", "https://static-js.com/js/dl.js", "https://static-js.com/js/dp.js", "https://static-js.com/js/stager.js", "https://static-js.com/js/tst.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — vSkimmer

False Positive Guidance

• Legacy Application Dependency on vSkimmer’s C2 Domain

  • Scenario: A critical, legacy internal web application (e.g., a custom-built inventory management system) still references the vSkimmer Command and Control (C2) domain in its configuration files or hardcoded JavaScript for a deprecated feature that hasn’t been updated in years. When users access this app, their browsers or client-side scripts initiate outbound connections to the known IOC domain, triggering the detection.
  • Filter/Exclusion: Exclude outbound connections to the specific vSkimmer domain if the source IP belongs to the known subnet of the legacy application’s web servers (e.g., 10.20.5.0/24) and the destination port is 80/443. Alternatively, add the specific domain to the “Known Legacy External Dependencies” allowlist if it is confirmed to be benign and not actively used for C2.

• Scheduled Backup or Sync Job Using vSkimmer’s IP Range

  • Scenario: An enterprise backup solution (e.g., Veeam or Commvault) or a data synchronization tool (e.g., Synology Drive, Nextcloud) is configured to sync data to a cloud storage endpoint or off-site server that happens to reside within the same IP range or ASN as a vSkimmer IOC. The scheduled job (e.g., running daily at 02:00 AM) generates periodic outbound traffic to that IP, which matches the IOC list.
  • Filter/Exclusion: Exclude traffic to the specific vSkimmer IP if the source process is a known backup or sync agent (e.g., veeam.exe, synology-drive.exe) and the traffic occurs during the defined maintenance window. Add an exclusion rule for the specific IP address if it is confirmed to be a legitimate cloud storage provider endpoint used by the organization.