Hujumchilar Magento va Adobe Commerce'dagi muhim StyleSmuggler zaifligidan foydalanib PSK Agent — buyrug'larni bajarish, trafikni proksi qilish va serverga doimiy kirishni ta'minlaydigan masofaviy kirish troyanini joylashtirishdi.
Kampaniya 2026-yil 9–13-sentabr kunlari o'tkazilib, G'arbiy Yevropa, Shimoliy Amerika va Osiyo-Tinch okeani mintaqalaridagi do'konlarga qaratildi.
Imperva'ning avvalgi tahlili CVSS balli 10.0 ekanligini va Adobe'ning shoshilinch tuzatishidan oldin ekspluatatsiya qilinganini xabar qiladi.
Tadqiqotchilar /paypal/transparent/response/ manziliga qarshi deyarli bir xil PHP yuklamalaridan foydalanadigan beshta hujum klasterini aniqlashdi.
Takrorlanadigan yetkazib berish URL'i — transfer[.]chinow[.]abrdns[.]com/get/psk_agent.sh — 12 ta yuklama variantida 96 marta uchradi, bu alohida kirishlar emas, balki standartlashtirilgan ekspluatatsiyani ko'rsatadi.
Kuzatilgan trafikning aksariyat qismini to'rtta manba manzili hosil qildi: 132[.]243[.]238[.]178, 86[.]107[.]100[.]105, 185[.]18[.]222[.]13 va 64[.]204[.]130[.]9.
Ularning geografik tarqalishi ijaraga olingan yoki buzilgan infratuzilma bilan mos keladi va o'z-o'zidan operatorning jismoniy joylashuvi yoki millatini ishonchli dalil sifatida ko'rsatmaydi.
Hujum PHP manba kodini endpointning so'rov satriga joylashtirish bilan boshlanadi. Magento zararli so'rovni var/report/ katalogidagi nosozlik hisobotida qayd etadi.
Keyingi /graphql so'rovi hujumchi nazoratidagi styles parametrlarini suiiste'mol qilib, zaharlangan hisobotni yuklaydi va undagi o'rnatilgan PHP kodini bajaradi. Tegishli variantlar yoziladigan ilova jurnallarini ham nishonga oladi.
Bajarish muvaffaqiyatli bo'lgach, yuklama shell_exec, system va exec funksiyalarini ketma-ket sinab ko'radi, ba'zi variantlar esa passthru'ni ham qo'shadi.
Bu zaxira ketma-ketligi administratorlar alohida PHP funksiyalarini o'chirib qo'ygan hollarda ishonchlilikni oshiradi. So'ngra hujumchilar curl yordamida shell-skript yuklab oluvchini oladi va uni to'g'ridan-to'g'ri bash'ga yo'naltiradi.
3 313 baytli psk_agent.sh skripti $HOME, /tmp, /var/tmp va /dev/shm kataloglarida yoziladigan, bajariladigan joylarni qidiradi.
U curl, wget, Python 2 va Python 3 orqali yuklab olishni qo'llab-quvvatlaydi, so'ngra keyingi bosqichni setsid yoki nohup yordamida, chiqishni bostirib, ishga tushiradi.
Bu bosqich — chi_down — bu juda chalkash, 10,5 MB hajmli, 64-bitli Go binari bo'lib, qurilish ma'lumotlari o'chirilgan.
Uning imkoniyatlari: shell-buyruqlarini bajarish, xostni tekshirish, SOCKS5 proksi qilish va HTTP, HTTPS hamda shifrlangan ilova kanallari orqali aloqa qilish.
Imperva tadqiqotchilari aytishicha, CVE-2026-75650 sifatida kuzatilgan StyleSmuggler Magento shablonlarini qayta ishlash orqali autentifikatsiyasiz masofaviy kod bajarishga ruxsat beradi.
Ishga tushirish argumentlari orasida -checkagent=false va -maintain=true mavjud. Rejalashtirish funksiyasi va kuzatilgan doimiylik artefaktlari bilan birgalikda bu sozlamalar dastlabki kirishdan keyin ham kirishni saqlab qolish urinishini ko'rsatadi.
Nishonga olingan sohalar (Manba: Imperva).
Yuklab oluvchi VirusTotal'da tahlil qilinganda nol aniqlash qayd etgan; bu tarixiy natija hozirgi aniqlash qamrovini belgilamaydi.
Ba'zi yuklamalar jabrlanuvchi xost nomini 0f851bdc9d[.]ddns[.]1433[.]eu[.]org ostidagi subdomenlarga joylashtiradi, bu esa HTTP so'rovlarini va DNS so'rovlarini ishga tushiradi.
Shunday qilib, hujumchi nazoratidagi avtoritetli DNS HTTP qayta chaqiruvlari muvaffaqiyatsiz bo'lganda ham muvaffaqiyatli bajarishni tasdiqlashi mumkin.
Boshqa hujumlar transfer[.]onlypsk[.]abrdns[.]com'dan t4.php'ni yuklab oladi va uni Magento'ning kirish mumkin bo'lgan kataloglarida, jumladan pub/media/'da zer4.php sifatida saqlaydi.
910 qatorli vebshell fayl boshqaruvi, PHP baholashi va operatsion tizim buyruqlarini qo'llab-quvvatlaydi.
Uning PHP Foreign Function Interface (FFI) imkoniyati libc'ni to'g'ridan-to'g'ri chaqirishga imkon beradi, bu esa tez-tez suiiste'mol qilinadigan bajarish funksiyalaridagi cheklovlarni chetlab o'tishi mumkin. Buyruqlar AES-256-CBC shifrlash bilan umumiy qattiq kodlangan kalit yordamida shifrlanadi.
Xitoy tilidagi izohlar va infratuzilma nomlari ehtimol xitoy tilida so'zlashuvchi ishlab chiquvchi yoki operatorni ko'rsatadi, bu o'rtacha ishonch bilan baholanadi.
Ular hech qanday nomlangan guruh yoki hukumat tomonidan javobgarlikni belgilamaydi. PSK Agent avvalgi StyleSmuggler tadqiqotida tasvirlangan Rust backdoor'dan ham farq qiladi, bu esa bir xil kirish nuqtasidan foydalanadigan bir nechta operatorlar mavjudligini ko'rsatadi.
Administratorlar Adobe'ning VULN-39341 tuzatishini qo'llashlari va ochiq serverlarni tekshirishlari kerak, tuzatishni yo'q qilish deb qabul qilmasliklari lozim.
Ustuvor tekshiruvlar: kutilmagan PHP fayllari, chi_down, cron va systemd doimiyligi, shubhali DNS so'rovlari va veb-server jarayonlaridan chiquvchi ulanishlar.
Tasdiqlangan buzilish doimiylikni yo'q qilish va kirish mumkin bo'lgan ma'lumotlarni — Magento shifrlash kalitlari, integratsiya tokenlari va to'lov shlyuzi sirlarini — aylantirishni talab qiladi.
IOC'lar
Ko'rsatkichTuriRoli 132.243.238.178 IP Hujum manbai 86.107.100.105 IP Hujum manbai 185.18.222.13 IP Hujum manbai 64.204.130.9 IP Hujum manbai
Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola yaratishni oldini olish uchun ataylab defanged (masalan, [.]) qilingan. Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedkasi platformalarida qayta fang qiling.
Attackers exploited the critical StyleSmuggler vulnerability in Magento and Adobe Commerce to deploy PSK Agent, a remote access trojan enabling command execution, traffic proxying, and persistent server access.
The campaign ran September 9–13, 2026, targeting stores across Western Europe, North America, and Asia-Pacific.
Imperva’s earlier analysis reports a CVSS score of 10.0 and exploitation preceding Adobe’s emergency hotfix.
Researchers identified five attack clusters using nearly identical PHP payloads against /paypal/transparent/response/.
A recurring delivery URL, transfer[.]chinow[.]abrdns[.]com/get/psk_agent.sh, appeared 96 times across 12 payload variants, suggesting standardized exploitation rather than isolated intrusions.
Four source addresses generated most observed traffic: 132[.]243[.]238[.]178, 86[.]107[.]100[.]105, 185[.]18[.]222[.]13, and 64[.]204[.]130[.]9.
Their geographic spread is consistent with rented or compromised infrastructure, not reliable evidence of the operator’s physical location or nationality on its own.
The attack begins by placing PHP source in the endpoint’s query string. Magento records the malicious request in a failure report under var/report/.
A subsequent /graphql request abuses attacker-controlled styles parameters to load the poisoned report and execute its embedded PHP. Related variants target writable application logs.
Once execution succeeds, the payload cycles through shell_exec, system, and exec, with some variants adding passthru.
This fallback sequence increases reliability when administrators have disabled individual PHP functions. Attackers then retrieve the shell-script dropper with curl and pipe it directly into bash.
The 3,313-byte psk_agent.sh script searches $HOME, /tmp, /var/tmp, and /dev/shm for writable, executable locations.
It supports downloads through curl, wget, Python 2, and Python 3, then launches its next stage using setsid or nohup while suppressing output.
That stage, chi_down, is a heavily obfuscated, 10.5 MB, 64-bit Go binary with stripped build information.
Its capabilities include shell-command execution, host reconnaissance, SOCKS5 proxying, and communications over HTTP, HTTPS, and encrypted application channels.
Imperva Researchers said that, tracked as CVE-2026-75650, StyleSmuggler permits unauthenticated remote code execution through Magento’s template processing.
Launch arguments include -checkagent=false and -maintain=true. Combined with scheduling functionality and observed persistence artifacts, these settings indicate an effort to retain access beyond the initial intrusion.
Targeted industries (Source : Imperva).
The dropper reportedly registered zero detections on VirusTotal when analyzed; that historical result does not establish current detection coverage.
Some payloads embed the victim hostname into subdomains beneath 0f851bdc9d[.]ddns[.]1433[.]eu[.]org, triggering HTTP requests and DNS lookups.
Attacker-controlled authoritative DNS can therefore confirm successful execution even when HTTP callbacks fail.
Other attacks download t4.php from transfer[.]onlypsk[.]abrdns[.]com and save it as zer4.php in accessible Magento directories, including pub/media/.
The 910-line webshell supports file management, PHP evaluation, and operating-system commands.
Its PHP Foreign Function Interface capability can invoke libc directly, potentially bypassing restrictions on commonly abused execution functions. Commands use AES-256-CBC encryption with a shared hardcoded key.
Chinese-language comments and infrastructure naming suggest a likely Chinese-speaking developer or operator, assessed with moderate confidence.
They do not establish responsibility by any named group or government. PSK Agent also differs from the Rust backdoor described in earlier StyleSmuggler research, indicating multiple operators exploiting the same entry point.
Administrators should apply Adobe’s VULN-39341 hotfix and investigate exposed servers rather than treating patching as eradication.
Priority checks include unexpected PHP files, chi_down, cron and systemd persistence, suspicious DNS queries, and outbound connections from web-server processes.
Confirmed compromise requires removing persistence and rotating accessible credentials, Magento encryption keys, integration tokens, and payment-gateway secrets.
IOCs
IndicatorTypeRole 132.243.238.178 IP Attack source 86.107.100.105 IP Attack source 185.18.222.13 IP Attack source 64.204.130.9 IP Attack source
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
