FishPig Magento extensions delivered ReKoobe
FishPig's paid Magento 2 extension distribution was compromised in 2022, and altered extension code downloaded the ReKoobe Linux backdoor from FishPig infrastructure when a logged-in Magento staff user visited the FishPig control panel.
Story
FishPig sold Magento extensions that integrated Adobe Commerce and Magento stores with WordPress. That made its paid module distribution path a natural bridge into ecommerce servers: administrators installed the extension to run their storefront, then trusted the module's license checks and backend control panel code as part of normal operations.
The attackers changed License.php, a file normally involved in FishPig license validation. When a logged-in Magento staff user opened the FishPig control panel, the altered code fetched lic.png from license.fishpig.co.uk, saved it as lic.bin, made it executable, ran it with the store's admin domain, and removed the temporary file. The innocent-looking license asset was the ReKoobe Linux backdoor.
ReKoobe used /tmp/.varnish7684 as a guard file, deleted its files after launch, stayed resident in memory, and disguised itself as common system processes such as cron, udevd, auditd, rsyslogd, or dbus-daemon. Sansec reported the malware waited for commands from 46.183.217.223 in Latvia, giving attackers remote control over affected ecommerce servers.
The date boundary is imprecise but important. Sansec said the FishPig distribution server was compromised on or before August 19, 2022, while The Register cited FishPig's disclosure that products were altered as early as August 6. FishPig recommended customers reinstall all paid modules, scan servers, and restart hosts to kill hidden in-memory processes.
Affected Artifacts
- Observed
- 2022-08-06 to 2022-09-13
- Compromised Versions
- Unknown
- Fixed
- Not listed
- Evidence
- distribution: fishpig.co.uk/magento-2/extensions, distribution: fishpig.co.uk/magento/wordpress-integration, mirror: sansec.io/research/rekoobe-fishpig-magento, file: License.php , +9 more
- Sansec reported malware in FishPig Magento Security Suite and several other FishPig Magento 2 extensions, and said all paid FishPig extensions were likely compromised.
- Free FishPig extensions hosted on GitHub appeared not to be affected.
- Sansec reported more than 200,000 downloads for FishPig software on Packagist; the number of paid-extension customers affected was unknown.
Incident Context
- Motive
- Remote Access
- Cause
- Vendor Server Compromise
- Transitive
- No
External References
Source record: proprietary/fishpig/meta.yaml