CosmicSting attack & defense overview
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-2961 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the… | 7.3 | 88% | ||
| CVE-2024-34102 | XXE vulnerability enabling RCE in Adobe Commerce and Magento Open Source | 9.8 | 100% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdnstatics.net | abg.com/pub/health_check.php Group Polyovki: Basic embed of cdnstatics.net This group is highly prolific with 623 hacked stores to dat |
| domain | cdnstatistics.net | 623 hacked stores to date. Attackers inject a reference to cdnstatistics.net : < script src = "https://cdnstatics.net/lib.js" > </ scrip |
| ipv4 | 142.252.84.169 | bly proxies) to inject their malicious payload into stores: 142.252.84.169 Group Burunduki: Custom port websocket sniffer The followin |
| ipv4 | 157.230.230.193 | e entry points, but usually there is a log entry like this: 157.230.230.193 - "POST /rest/V1/guest-carts/123456/estimate-shipping-metho |
| ipv4 | 185.175.225.116 | discovered the first CosmicSting attacks in the wild (from 185.175.225.116 ) Jun 26th: AssetNote publishes attack details and the firs |
| ipv4 | 82.202.161.175 | 55 82.202.165.43 82.202.165.36 82.202.165.48 82.202.161.191 82.202.161.175 82.202.161.192 82.202.162.237 82.202.163.228 82.202.165.158 |
| ipv4 | 82.202.161.191 | .96 82.202.165.55 82.202.165.43 82.202.165.36 82.202.165.48 82.202.161.191 82.202.161.175 82.202.161.192 82.202.162.237 82.202.163.228 |
| ipv4 | 82.202.161.192 | 3 82.202.165.36 82.202.165.48 82.202.161.191 82.202.161.175 82.202.161.192 82.202.162.237 82.202.163.228 82.202.165.158 82.202.165.152 |
| ipv4 | 82.202.162.237 | 82.202.165.48 82.202.161.191 82.202.161.175 82.202.161.192 82.202.162.237 82.202.163.228 82.202.165.158 82.202.165.152 However, this |
| ipv4 | 82.202.163.228 | 82.202.161.191 82.202.161.175 82.202.161.192 82.202.162.237 82.202.163.228 82.202.165.158 82.202.165.152 However, this group also uses |
| ipv4 | 82.202.165.152 | 82.202.161.192 82.202.162.237 82.202.163.228 82.202.165.158 82.202.165.152 However, this group also uses other IPs (presumably proxies |
| ipv4 | 82.202.165.158 | 82.202.161.175 82.202.161.192 82.202.162.237 82.202.163.228 82.202.165.158 82.202.165.152 However, this group also uses other IPs (pre |
| ipv4 | 82.202.165.36 | 2 ). 82.202.165.8 82.202.165.96 82.202.165.55 82.202.165.43 82.202.165.36 82.202.165.48 82.202.161.191 82.202.161.175 82.202.161.192 |
| ipv4 | 82.202.165.43 | tacks ( AS29182 ). 82.202.165.8 82.202.165.96 82.202.165.55 82.202.165.43 82.202.165.36 82.202.165.48 82.202.161.191 82.202.161.175 8 |
| ipv4 | 82.202.165.48 | 5.8 82.202.165.96 82.202.165.55 82.202.165.43 82.202.165.36 82.202.165.48 82.202.161.191 82.202.161.175 82.202.161.192 82.202.162.237 |
| ipv4 | 82.202.165.55 | CosmicSting attacks ( AS29182 ). 82.202.165.8 82.202.165.96 82.202.165.55 82.202.165.43 82.202.165.36 82.202.165.48 82.202.161.191 82 |
| ipv4 | 82.202.165.8 | wing IPs are implicated in CosmicSting attacks ( AS29182 ). 82.202.165.8 82.202.165.96 82.202.165.55 82.202.165.43 82.202.165.36 82. |
| ipv4 | 82.202.165.96 | implicated in CosmicSting attacks ( AS29182 ). 82.202.165.8 82.202.165.96 82.202.165.55 82.202.165.43 82.202.165.36 82.202.165.48 82. |
From the original article
10 min read at sansec.io
CosmicSting targets a critical bug in the Adobe Commerce and Magento platforms. Bad actors use it to read any of your files, such as passwords and other secrets. The typical attack strategy is to steal your secret crypt key from app/etc/env.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.