Keeper
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 6 incidents
- Sources
- 0 sources
- First seen
- 2020-10-01
- Last seen
- 2021-04-29
- Updated
- 2026-10-12 08:36
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Keeper, also known as the Keeper hacking group, is a threat actor linked to Russia and primarily conducts financially motivated Magecart skimming attacks against online restaurant ordering platforms. The group compromises centralized payment systems—both direct ordering infrastructures and third‑party aggregation services—to intercept card‑not‑present transaction data, leading to the exposure of hundreds of thousands of payment cards. Observed tactics include injecting skimming code into web platforms and exploiting vulnerabilities in third‑party services, with no public indication of state sponsorship or affiliation with a larger criminal consortium. Representative operations include the April 2021 breach that affected multiple ordering platforms and exposed approximately 343,000 cards, and a similar October 2020 incident involving the same attack methodology.
Incidents
Attributed incidents are available to members.
6 incidentsSources
Sources available to members: 0 sources.