Threat actorcritical
Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-34102 | XXE vulnerability enabling RCE in Adobe Commerce and Magento Open Source | 9.8 | 100% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdnstatics.net | e Bobry victims is Segway. Group Polyovki: Script embed via cdnstatics.net A highly prolific group, that so far infected over 650 stor |
| domain | fallodick87-78.sbs | r 42 to encrypt its payload and operates through the domain fallodick87-78.sbs : < svg width = "1px" height = "1px" onload = "!function(aa |
From the original article
5 min read at sansec.io
Sansec research shows that seven different groups have been hacking into 4275 online stores since the publication of CVE-2024-34102 (also known as CosmicSting ) on June 11th. Despite ongoing warnings , five percent of all Adobe Commerce and Magento stores ended up with a payment skimmer on their checkout page this summer. NB : Sansec has reached out to all 4275 merchants with remediation instructions.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.