Attackers deploy Linux backdoor on e-stores compromised with software skimmer

guest · Nov 18, 2021

Attackers deploy Linux backdoor on e-stores compromised with software skimmer
November 18, 2021
https://securityaffairs.co/wordpress/124748/malware/linux-backdoor-e-stores-skimmer.html

Security researchers from Sansec Threat Research Team discovered a Linux backdoor during an investigation into the compromised of an e-commerce server with a software skimmer.

The attackers initially conducted a reconnaissance phase by probing the e-store with automated eCommerce attack probes. After a day and a half, the threat actors found and exploited a file upload vulnerability in one of the e-store’s plugins to upload a webshell and inject a software skimmer.
Click to expand...

The attackers also uploaded a Linux backdoor (linux_avp) written in Golang that disguises as a fake ps -off process. The analysis of the backdoor revealed that it was able to receive commands from a server hosted on Alibaba (47.113.202.35). The backdoor injects a malicious crontab entry to achieve persistence.

“At the time of writing, no other anti-virus vendor recognize this malware. Curiously, one individual had submitted the same malware to Virustotal on Oct 8th with the comment “test”.” reads the post published by Sansec Threat Research Team.
Click to expand...

At the time of this writing, the backdoor has a zero-detection rate on the anti-malware engines on VirusTotal a month after it was first uploaded on the platform.

“The person uploading the malware could very well be the malware author, who wanted to assert that common anti-virus engines will not detect their creation.” concludes the post.
Click to expand...

Sansec: Linux malware agent hits eCommerce sites

Sansec discovered a new malicious agent “linux_avp” that hides as system process on eCommerce servers. It is being deployed around the world since last week and takes commands from a control server in Beijing.
Malicious Golang server agent
We found that the attacker started with automated eCommerce attack probes, testing for dozens of weaknesses in common online store platforms. After a day and a half, the attacker found a file upload vulnerability in one of the store’s plugins.

Interestingly, the attacker also uploaded a Linux executable called linux_avp. This Golang program starts, removes itself from disk, and disguises as a fake ps -ef process.
Click to expand...

Log in or Sign up

Attackers deploy Linux backdoor on e-stores compromised with software skimmer

guest Guest

Log in or Sign up

Attackers deploy Linux backdoor on e-stores compromised with software skimmer

guest Guest

Useful Searches