Pulse Detail — Threat Intelligence

PULSE NAME

Persistent backdoors injected on Adobe Commerce via new CosmicSting attack

WHITE CyberHunter_NL 2024-10-03 Modified: 2024-11-02

IOCs

MEDIUM VOLUME

Indicators of Compromise (41)

All CVE URL domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
CVE	CVE-2024-2961	—	2024-10-03
CVE	CVE-2024-34102	—	2024-10-03
URL	http://accept.bar/common	—	2024-10-03
URL	http://amocha.xyz/common	—	2024-10-03
URL	http://cd.iconstaff.top/m	—	2024-10-03
URL	http://cdn-webstats.com/ls	—	2024-10-03
URL	http://cdn.iconstaff.top/common	—	2024-10-03
URL	http://cdn.inspectdlet.net/ws	—	2024-10-03
URL	http://clearnetfab.net/common	—	2024-10-03
URL	http://fallodick87-78.sbs/common	—	2024-10-03
URL	http://jqueryuslibs.com/common	—	2024-10-03
URL	http://jstatic201.com/common	—	2024-10-03
URL	http://lererikal.org/common	—	2024-10-03
URL	http://mamatmavali.ru/common	—	2024-10-03
URL	http://nothingillegal.bond/common	—	2024-10-03
URL	http://paie-locli.com/s	—	2024-10-03
URL	http://sellerstat.site/wss	—	2024-10-03
URL	http://statsseo.com/common	—	2024-10-03
URL	http://statstoday.org/common	—	2024-10-03
URL	http://vincaolet.xyz/socket	—	2024-10-03
URL	http://webexcelsior.org/common	—	2024-10-03
domain	accept.bar	—	2024-10-03
domain	amocha.xyz	—	2024-10-03
domain	cdn-webstats.com	—	2024-10-03
domain	clearnetfab.net	—	2024-10-03
domain	ecomscan.com	—	2024-10-03
domain	fallodick87-78.sbs	—	2024-10-03
domain	jqueryuslibs.com	—	2024-10-03
domain	jstatic201.com	—	2024-10-03
domain	lererikal.org	—	2024-10-03
domain	mamatmavali.ru	—	2024-10-03
domain	nothingillegal.bond	—	2024-10-03
domain	paie-locli.com	—	2024-10-03
domain	sellerstat.site	—	2024-10-03
domain	statsseo.com	—	2024-10-03
domain	statstoday.org	—	2024-10-03
domain	vincaolet.xyz	—	2024-10-03
domain	webexcelsior.org	—	2024-10-03
hostname	cd.iconstaff.top	—	2024-10-03
hostname	cdn.iconstaff.top	—	2024-10-03
hostname	cdn.inspectdlet.net	—	2024-10-03

References (1)

↗ https://sansec.io/research/cosmicsting-cnext-persistent-backdoor