Since January 2023, there was an ongoing marketing campaign focusing on e-commerce websites that use Adobe’s Magento 2 software program. This marketing campaign, referred to as Xurum, exploits a crucial safety flaw in Adobe Commerce and Magento Open Source that has now been patched. If efficiently exploited, this flaw might result in arbitrary code execution. The attackers behind Xurum, believed to be of Russian origin, are primarily fascinated with payment stats from the orders made prior to now 10 days.
In addition to exploiting the safety flaw, the attackers have additionally contaminated some web sites with JavaScript-based skimmers. These skimmers gather bank card data and ship it to a distant server. The full extent of the marketing campaign is presently unknown.
The assault chain utilized by the attackers includes weaponizing CVE-2022-24086 for preliminary entry after which utilizing it to execute malicious PHP code. This code gathers details about the host and deploys an internet shell named wso-ng, disguised as a Google Shopping Ads part. The internet shell solely prompts when the attacker sends the cookie “magemojo000” within the HTTP request. Once activated, it accesses and exfiltrates details about the gross sales order payment strategies from the previous 10 days. The assaults conclude with the creation of a rogue admin consumer with the names “mageworx” or “mageplaza,” that are in style Magento 2 extension shops.
The internet shell wso-ng is an evolution of the WSO internet shell and features a hidden login web page to steal credentials. It additionally integrates with authentic instruments like VirusTotal and SecurityTrails to assemble details about the contaminated machine’s IP fame and different domains hosted on the identical server.
The attackers behind Xurum reveal a meticulous and focused method, specializing in particular Magento 2 cases reasonably than launching indiscriminate assaults. They present a excessive stage of experience in Magento and make investments appreciable time in understanding its internals and establishing their assault infrastructure.
Source hyperlink