ATMZOW and Hancitor – Birds of the Same Feather Flocking Together?

Group-IB found a link between the ATMZOW JS Sniffer campaign and the Hancitor malware downloader, claiming to be operated by the same malicious actors. The use of the same JS obfuscation method and similar domain names were found in campaigns by ATMZOW and Hancitor. Group-IB posted a number of IOCs connected to the attacks.