These groups are all using the same basic family of malicious code, collectively referred to as Magecart. Their preferred targets are websites that use the Magento e-commerce platform. Although historically, they haven't been bashful about targeting other e-commerce platforms as well.
The gist of how they do their damage amounts to digital skimming. This type of attack is conducted by first penetrating your site's security features. This allows the hackers to inject malicious code onto your site that monitors any transactions that take place when your customers make a purchase from you. In the process, they are "skimming" their payment details and sending them off to a server under the control of the hackers, where they can make use of the payment data for their own purposes.
Given the nature of the attack, there's no outward sign that your customers' payment information has been compromised. They'll only find out later, when transactions they have not authorized begin appearing on their payment card statements.
In tandem with the research conducted by RiskIQ, Malwarebytes security researcher Jerome Segura has uncovered a new twist on the basic Magecart skimming tactic. This new tactic sees attackers injecting e-commerce sites with code that causes it to pop up a malicious iFrame at the time of payment. Then, the user simply hands over their payment data, not suspecting that it's not a normal part of the e-commerce platform.
In whatever way it is accomplished, the researchers following the development and maturation of Magecart attacks all agree on one thing. Once the data has been collected, it is sent to a server somewhere in Russia. Beyond that, the trail becomes too tangled to follow.
Stay alert, and make sure your IT folks are on guard against the threat. Your customers will thank you for it.