XE Group – Exposed: 8 Years of Hacking & Card Skimming for Profit
Summary: Volexity identified compromises in 2020 and 2021 tied to a self-named "XE Group," a likely Vietnamese-origin criminal actor that compromises IIS web servers and injects credit card skimming JavaScript, loading it from domains such as object[.]fm and object.sbs via a technique that resolves typeof({}) to "object." Volexity linked the group's infrastructure through shared nameservers (ns1.xegroups[.]com and ns2.xegroups[.]com), WHOIS records, and a "xethanh" persona on GitHub, YouTube, and carding forums, with the oldest related malware sample dating to late 2014 and the persona's history going back to 2013.
Key Takeaway: The group's skimmed form data includes card numbers, expiration dates, and security codes, and in one case the attacker compromised a web design company that maintains storefront sites, meaning every site that company owned was serving a skimmer. The operation has run since at least early 2020 on a limited, easily pivoted set of infrastructure, with only one significant public mention in roughly eight years.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026