Hackers deploy Linux malware on e-commerce servers

Security researchers have discovered attackers deploying a Linux backdoor on compromised e-commerce servers after injecting a credit-card skimmer into online shops.

The PHP-coded web skimmer, a script designed to steal customers' payment and personal information, is added to the /app/design/frontend/ folder and disguised as a .JPG image.

Linux malware undetected by security software

The Golang-based malware, found on the same server by Dutch cybersecurity company Sansec, was downloaded and executed on compromised servers as the linux_avp executable.

Once launched, it immediately removes itself from disk and disguises itself as a ps -ef process, normally used to retrieve a list of currently running processes.

While analysing the linux_avp backdoor, Sansec found it waits for commands from a Beijing server hosted on Alibaba's network.

The researchers also found the malware gains persistence by adding a crontab entry that downloads the malicious payload again from its command-and-control server and reinstalls the backdoor if detected and removed, or if the server is restarted.

So far, the backdoor remains undetected by VirusTotal's anti-malware engines, even though a sample was first uploaded more than a month ago, on 8 October.

The uploader may be linux_avp's creator, as the sample was submitted one day after Sansec researchers detected it while investigating the e-commerce site compromise.