UltraRank is a financially motivated cybercriminal group specializing in e-skimming attacks that emerged as early as 2015. Over time, the group evolved its infrastructure and malicious code, leading to numerous misattributions of their campaigns to other threat actors, particularly within the broader Magecart umbrella. Assessed with high confidence to be of Russian origin due to linguistic indicators from an affiliated card shop operator, UltraRank's primary motivation is to steal payment card data for financial gain. The group distinguishes itself through an autonomous business model that includes operating its own card shop, ValidCC, for monetizing stolen data. This unique approach, along with their competitive tactics, such as attacking rival groups and phishing pages impersonating their own card shop, sets them apart from typical e-skimming operations.