My security audit of `tactical-expressions.com` (2026-09-24, Magento 2.4.8-p4)

Other
, ,
1

1

I have found 78 malware files in your Magento installation.

2

Attackers uploaded them by exploiting vulnerabilities in Magento's product custom options mechanism:

  • «CosmicSting»
  • «PolyShell»:
    The attackers executed the uploads across 11 infection waves (including automated mass attacks).

3

Chronology of the 11 infection waves (78 files in total):

3.1. 2026-09-12

2 cryptocurrency miner droppers kworker-linux (spec_*.gif):

  1. pub/media/custom_options/quote/s/p/spec_7f201d5dbc3d2fed.gif
  • pub/media/custom_options/quote/s/p/spec_047cd6a28c334ef7.gif

3.2. 2026-07-16

20 PHP uploaders sergei_789396 in a mass attack (every 1–2 minutes):

  1. pub/media/custom_options/quote/s/e/sergei_789396.gif
  • pub/media/custom_options/quote/s/e/sergei_789396.png
  • pub/media/custom_options/quote/s/e/sergei_789396.jpg
  • pub/media/custom_options/quote/s/e/sergei_789396.jpeg
  • pub/media/custom_options/quote/s/e/sergei_789396_1.gif
  • pub/media/custom_options/quote/s/e/sergei_789396_1.png
  • pub/media/custom_options/quote/s/e/sergei_789396_1.jpg
  • pub/media/custom_options/quote/s/e/sergei_789396_1.jpeg
  • pub/media/custom_options/quote/s/e/sergei_789396_2.gif
  • pub/media/custom_options/quote/s/e/sergei_789396_2.png
  • pub/media/custom_options/quote/s/e/sergei_789396_2.jpg
  • pub/media/custom_options/quote/s/e/sergei_789396_2.jpeg
  • pub/media/custom_options/quote/s/e/sergei_789396_3.gif
  • pub/media/custom_options/quote/s/e/sergei_789396_3.png
  • pub/media/custom_options/quote/s/e/sergei_789396_3.jpg
  • pub/media/custom_options/quote/s/e/sergei_789396_3.jpeg
  • pub/media/custom_options/quote/s/e/sergei_789396_4.gif
  • pub/media/custom_options/quote/s/e/sergei_789396_4.png
  • pub/media/custom_options/quote/s/e/sergei_789396_4.jpg
  • pub/media/custom_options/quote/s/e/sergei_789396_4.jpeg

3.3. 2026-07-15

20 PHP uploaders sergei_761097 in a mass attack (every 2–3 minutes):

  1. pub/media/custom_options/quote/s/e/sergei_761097.gif
  • pub/media/custom_options/quote/s/e/sergei_761097.png
  • pub/media/custom_options/quote/s/e/sergei_761097.jpg
  • pub/media/custom_options/quote/s/e/sergei_761097.jpeg
  • pub/media/custom_options/quote/s/e/sergei_761097_1.gif
  • pub/media/custom_options/quote/s/e/sergei_761097_1.png
  • pub/media/custom_options/quote/s/e/sergei_761097_1.jpg
  • pub/media/custom_options/quote/s/e/sergei_761097_1.jpeg
  • pub/media/custom_options/quote/s/e/sergei_761097_2.gif
  • pub/media/custom_options/quote/s/e/sergei_761097_2.png
  • pub/media/custom_options/quote/s/e/sergei_761097_2.jpg
  • pub/media/custom_options/quote/s/e/sergei_761097_2.jpeg
  • pub/media/custom_options/quote/s/e/sergei_761097_3.gif
  • pub/media/custom_options/quote/s/e/sergei_761097_3.png
  • pub/media/custom_options/quote/s/e/sergei_761097_3.jpg
  • pub/media/custom_options/quote/s/e/sergei_761097_3.jpeg
  • pub/media/custom_options/quote/s/e/sergei_761097_4.gif
  • pub/media/custom_options/quote/s/e/sergei_761097_4.png
  • pub/media/custom_options/quote/s/e/sergei_761097_4.jpg
  • pub/media/custom_options/quote/s/e/sergei_761097_4.jpeg

3.4. 2026-04-21

15 scripts with system($_GET['cmd']) (1342index.php*) in a mass attack over 15 seconds:

  1. pub/media/custom_options/quote/1/3/1342index.php.gif
  • pub/media/custom_options/quote/1/3/1342index.php_1.gif
  • pub/media/custom_options/quote/1/3/1342index.php_2.gif
  • pub/media/custom_options/quote/1/3/1342index.php_3.gif
  • pub/media/custom_options/quote/1/3/1342index.php_4.gif
  • pub/media/custom_options/quote/1/3/1342index.php.jpg
  • pub/media/custom_options/quote/1/3/1342index.php_1.jpg
  • pub/media/custom_options/quote/1/3/1342index.php_2.jpg
  • pub/media/custom_options/quote/1/3/1342index.php_3.jpg
  • pub/media/custom_options/quote/1/3/1342index.php_4.jpg
  • pub/media/custom_options/quote/1/3/1342index.php.png
  • pub/media/custom_options/quote/1/3/1342index.php_1.png
  • pub/media/custom_options/quote/1/3/1342index.php_2.png
  • pub/media/custom_options/quote/1/3/1342index.php_3.png
  • pub/media/custom_options/quote/1/3/1342index.php_4.png

3.5. 2026-04-20

6 GIF uploaders (upp.php*.gif) in a mass attack over 6 seconds:

  1. pub/media/custom_options/quote/u/p/upp.php.gif
  • pub/media/custom_options/quote/u/p/upp.php_1.gif
  • pub/media/custom_options/quote/u/p/upp.php_2.gif
  • pub/media/custom_options/quote/u/p/upp.php_3.gif
  • pub/media/custom_options/quote/u/p/upp.php_4.gif
  • pub/media/custom_options/quote/u/p/upp.php_5.gif

3.6. 2026-04-08

1 PHAR/JPG web shell (test_ninja.phar.jpg):

  1. pub/media/custom_options/quote/t/e/test_ninja.phar.jpg

3.7. 2026-04-04 — 2026-04-05

4 obfuscated base64 eval backdoors (cfg_ok_v3):

  1. pub/media/custom_options/quote/2/m/2movbbo2.gif
  • pub/media/custom_options/quote/u/a/ua9myddo.gif
  • pub/media/custom_options/quote/k/p/kpxj4pw6.gif
  • pub/media/custom_options/quote/o/z/oztj1ztg.gif

3.8. 2026-03-31 and 2026-04-17

2 PNG polyglot web shell uploaders (cute.png, cute_1.png):

  1. pub/media/custom_options/quote/c/u/cute.png
  • pub/media/custom_options/quote/c/u/cute_1.png

3.9. 2026-03-25 — 2026-03-26

2 PHP backdoors disguised as WordPress hooks (.txt):

  1. pub/media/custom_options/quote/7/5/724a496dec.txt
  • pub/media/custom_options/quote/4/0/3c97a55c82.txt

3.10. 2026-01-20

3 test JPEG polyglots (testingx-file-upload-test):

  1. pub/media/custom_options/quote/0/u/0uDHoUgx9TU8TVa3UEePSnMlvdWUqcSI
  • pub/media/custom_options/quote/3/E/3EFXmrRKbtxMwb5AvV528BH1Q5MrDKB6
  • pub/media/custom_options/quote/s/j/sjQ69AWNFLCf1ULyMvoecSyrrq3SStmB

3.11. 2025-11-29

3 test JPEG polyglots (testingx-file-upload-test):

  1. pub/media/custom_options/quote/v/5/v5Bts9hcCFo51gVhx6Wmkc7AcLvWWULj
  • pub/media/custom_options/quote/S/d/SdJ9xdM4Ww1oxV25HcxFOMa32h7OuSUx
  • pub/media/custom_options/quote/M/t/MtaVvMaxfLunjzjIEV80TaEWdXRIhhmC

4

Chronology of the infection waves in relation to CyberSolutions LLC's maintenance activity:

4.1. September 2026

CyberSolutions deployed TEX-37 (patch APSB26-146) on 2026-09-10 and TEX-36 (upgrade to Magento 2.4.8-p5) on 2026-09-22.
Between these deployments, on 2026-09-12, attackers uploaded 2 cryptocurrency miner droppers (kworker-linux).
Neither TEX-37 nor TEX-36 resolved the product custom options upload vulnerability.
The contractor did not detect the uploaded miner scripts.

4.2. July 2026

CyberSolutions merged TEX-29 on 2026-07-14.
On 2026-07-15 and 2026-07-16, automated mass attacks uploaded 40 PHP uploaders (sergei_*) over two days.
The contractor did not detect the attack.
On 2026-07-28, the contractor added 00-magento-nginx-hardening.conf to Nginx, but never inspected the filesystem or removed the 40 malware files from disk.

4.3. April 2026

CyberSolutions deployed TEX-23 (upgrade to Magento 2.4.8-p4) on 2026-04-15 as a security update.
Adobe had not patched the «PolyShell» vulnerability in 2.4.8-p4 (the fix was only introduced in 2.4.9-alpha3).
Five days later, on 2026-04-20 and 2026-04-21, attackers executed automated mass attacks, uploading 21 web shells (upp.php*.gif and 1342index.php*) in seconds.
The contractor did not detect or remove these files.

4.4. March 2026

On 2026-03-25 and 2026-03-26, attackers uploaded 2 WordPress-masked PHP backdoors (.txt).
On 2026-03-27, CyberSolutions discovered web shells on the server and deleted several *.php files manually via bash (rm ...).
Because the contractor searched only for *.php, they left behind the .txt backdoors and extensionless test files from earlier waves.
On 2026-03-27 at 21:52 UTC, the contractor committed MarkShust_PolyshellPatch, which only restricted file extensions to jpg, jpeg, gif, png.
The patch did not validate file contents for PHP code.
Beginning on 2026-03-31, attackers bypassed the patch by uploading polyglot images containing PHP code (cute.png, cfg_ok_v3 GIF backdoors, test_ninja.phar.jpg).

4.5. November 2025 — January 2026

On 2025-11-29 and 2026-01-20, attackers probed the custom options mechanism with 6 test JPEG polyglots (testingx-file-upload-test) saved without extensions.
The contractor performed routine maintenance but lacked filesystem integrity monitoring and never detected the probes.

5

Key reasons why infections occurred and persisted despite the contractor's work:

5.1

The third-party patch installed by the contractor on 2026-03-27 (MarkShust_PolyshellPatch) only checked file extensions (jpg, jpeg, gif, png) and did not inspect file contents for PHP code (<?php).
Attackers bypassed it by embedding PHP payloads inside valid image files (polyglots).

5.2

The contractor's manual cleanup on 2026-03-27 was superficial: the contractor searched only for *.php files, leaving .txt backdoors and extensionless polyglots on disk.

5.3

The contractor's Magento upgrades (TEX-23 to 2.4.8-p4, TEX-36 to 2.4.8-p5) and patches (TEX-37 for APSB26-146) did not fix the product custom options polyglot upload vulnerability, which Adobe only addressed in 2.4.9-alpha3.

5.4

The contractor did not implement filesystem integrity monitoring, automated file scans, or alerting for unauthorized uploads in pub/media/custom_options/.

5.5

Although direct HTTP access to pub/media/custom_options/ was blocked in Nginx, leaving 78 executable PHP files on disk exposes the server to local execution via any Local File Inclusion (LFI), deserialization, or template injection vulnerability.

6

Also, CyberSolutions LLC missed 6 vulnerable Amasty modules that allow remote code execution and data leaks on your website:

  • Amasty_StoreCredit
  • Amasty_GiftCard
  • Amasty_GiftCardAccount
  • Amasty_ExportCore
  • Amasty_ImportCore
  • Amasty_ImportExportCore

These vulnerabilities are documented by:

CyberSolutions LLC never updated these modules, leaving your store exposed to remote attacks.