Security News > 2022 > September > WordPress-powered sites backdoored after FishPig suffers supply chain attack
Infosec outfit Sansec raised the alarm this week that FishPig's software was acting weird: when a deployment's control panel was visited by a logged-in Magento staff user, the code would automatically fetch and run from FishPig's back-end systems a Linux binary that turned out to be Rekoobe.
Free versions of FishPig modules available on GitHub were likely clean.
According to FishPig, it's "Best to assume that all paid FishPig Magento 2 modules have been infected." It's not known exactly how many customers were caught up in the supply-chain attack, though Sansec said the company's free Magento packages have been collectively downloaded more than 200,000 times.
Ergo, a staff user accesses their FishPig deployment's control panel, the altered remotely-hosted License.
Per Intezer, newer versions of Rekoobe show hard-coded C2 server addresses and attempt to rename their own process, as is the case in this FishPig instance.
FishPig said affected customers can also reach out for "a free clean up service for anyone who is worried that this is affecting their site and needs help to resolve it."
News URL
https://go.theregister.com/feed/www.theregister.com/2022/09/15/magento_wordpress_fishpig/
Related news
- Bybit Hack Traced to Safe{Wallet} Supply Chain Attack Exploited by North Korean Hackers (source)
- China-Linked Silk Typhoon Expands Cyber Attacks to IT Supply Chains for Initial Access (source)
- GitHub supply chain attack spills secrets from 23,000 projects (source)
- Supply chain attack on popular GitHub Action exposes CI/CD secrets (source)
- Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos (source)
- GitHub Action hack likely led to another in cascading supply chain attack (source)
- GitHub Action supply chain attack exposed secrets in 218 repos (source)
- Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed (source)
- ⚡ THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More (source)
- Recent GitHub supply chain attack traced to leaked SpotBugs token (source)