Security News > 2021 > November > Hackers deploy Linux malware, web skimmer on eCommerce servers

Security researchers discovered that attackers are also deploying a Linux backdoor on compromised e-commerce servers after injecting a credit card skimmer into online shops' websites.

"After a day and a half, the attacker found a file upload vulnerability in one of the store's plugins. S/he then uploaded a webshell and modified the server code to intercept customer data."

The Golang-based malware, spotted by Dutch cyber-security company Sansec on the same server, was downloaded and executed on breached servers as a linux avp executable.

While analyzing the linux avp backdoor, Sansec found that it waits for commands from a Beijing server hosted on Alibaba's network.

They also discovered that the malware would gain persistence by adding a new crontab entry that would redownload the malicious payload from its command-and-control server and reinstall the backdoor if detected and removed or the server restarts.

Until now, this backdoor remains undetected by anti-malware engines on VirusTotal even though a sample was first uploaded more than one month ago, on October 8th. The uploader might be the linux avp creator since it was submitted one day after researchers at Dutch cyber-security company Sansec spotted it while investigating the e-commerce site breach.

News URL

https://www.bleepingcomputer.com/news/security/hackers-deploy-linux-malware-web-skimmer-on-ecommerce-servers/