Posted on

2026-10-27 Magento deepveindrilling.com CMS Loader Campaign — Microsoft Sentinel Threat Hunts

Threat Overview

Sansec's October 24 research documents a continuing compromise campaign affecting 953 online stores since July 2025, predominantly Magento 2. The attacker injects JavaScript into the cms_block database table; browsers visiting affected stores request code from a rotating set of attacker-controlled loader domains. The current October domain is deepveindrilling.com, observed on 83 stores, including 60 previously compromised sites. On October 23 the loader was updated to fingerprint visitors and withhold malicious payloads from automated scanners. Sansec has not captured the current final-stage payload, so calling the October version a confirmed card skimmer would overstate the evidence; earlier infrastructure delivered crypto-themed scripts. The October rewrite does not demonstrate a new zero-day: earlier access included PolyShell and SessionReaper file-upload weaknesses, plus persistent rogue administrators/backdoors on patched stores. Removing the script without eliminating the underlying access does not remediate the intrusion. SecurityWeek independently covered the findings on October 26.

References

Impacted Systems

  • Vendor/platform: Magento Open Source / Adobe Commerce self-managed storefronts on Linux web/PHP and MySQL/MariaDB, including sites serving CMS blocks/pages to customers. Sansec's observed victims are mostly Magento; the exact edition and patch build for all 953 stores are not confirmed.
  • Exposure: attacker has a route to modify cms_block.content (for example, an existing webshell, unauthorized administrator, or previously exploited upload weakness). Public storefront visitors then load attacker-hosted JavaScript. A patched Magento core does not prove the site is clean.
  • Confirmed example: Magento 2.4.7-p1 with PolyShell webshells and CMS-block injection; another patched 2.4.7-p10 store was reinfected after a clean scan because prior rogue access persisted. These are observations, not an exhaustive vulnerable-version range.
  • Related exposure: PolyShell CVE-2026-48356, remediated through Adobe security bulletin APSB26-73, and SessionReaper CVE-2025-54236, addressed by APSB25-88. Verify fixed versions against the applicable Adobe product branch; the research does not establish a universal fixed Magento build for this loader campaign.
  • Indicators: current deepveindrilling.com with ?s=49b7ca5f&fp= and earlier ?s=d35c5031; prior loader domains additionalver.com, lanhd6549tdhse.top, neswnsssn.click, manulfie.click, hdfdsi84j3h.top, c85grt98sd.com. Prior-stage leqdger.click and crypto-insider.top are historical and not confirmed October payload destinations.
  • Unaffected: no Magento version is categorically immune to a previously installed backdoor or stolen administrator credential; no claim is made about Adobe Commerce Cloud deployments without corroborating evidence.

Why this matters

A small database-resident loader can persist through application patching, affect customers browsing the storefront and evade scanner-based validation. A multi-layer hunt combines outbound domain traffic, web requests to upload/backdoor paths, endpoint file creation, suspicious webserver child processes and forwarded application-log artifacts.

Exploitation Status

Confirmed ongoing malicious modification of storefront CMS blocks, with a fingerprinting rewrite observed October 23. Sansec documented 953 affected stores over 15 months and 83 on the newest domain. Some earlier infections followed confirmed upload vulnerabilities; do not attribute every reinfection to a new exploit. October payload outcome is not established.

What this hunt looks for

Hunts use exact researcher-published loader domains and reported webshell paths, endpoint PHP file writes, webserver shell launches, Magento-related HTTP upload paths and rare outbound connections. The strongest indicator is the known loader domain on a relevant storefront, but a negative network hunt does not replace database inspection.

Required logs

Each query requires its named Microsoft Sentinel table. No customer log ingestion or product deployment is assumed.

  • Hunt 01: CommonSecurityLog
  • Hunt 02: DeviceNetworkEvents
  • Hunt 03: AzureDiagnostics
  • Hunt 04: DeviceFileEvents
  • Hunt 05: DeviceProcessEvents
  • Hunt 06: Syslog
  • Hunt 07: CommonSecurityLog
  • Hunt 08: SecurityEvent

Hunt 01 — Current and historical Magento loader domain connections

let domains = dynamic(["deepveindrilling.com","additionalver.com","lanhd6549tdhse.top","neswnsssn.click","manulfie.click","hdfdsi84j3h.top","c85grt98sd.com"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| extend Host=tolower(tostring(DestinationHostName)), Url=tolower(tostring(RequestURL))
| where Host has_any (domains) or Url has_any (domains)
| project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, DestinationHostName, RequestURL, DeviceAction
| order by TimeGenerated desc

Hunt 02 — Known Magento loader domains in endpoint DNS and network telemetry

DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any ("deepveindrilling.com","additionalver.com","lanhd6549tdhse.top","neswnsssn.click","manulfie.click","hdfdsi84j3h.top","c85grt98sd.com")
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Hunt 03 — Magento media upload or known webshell path in Azure WAF

AzureDiagnostics
| where TimeGenerated > ago(30d)
| where Category in ("ApplicationGatewayFirewallLog","FrontDoorWebApplicationFirewallLog")
| extend Uri=tolower(tostring(column_ifexists("requestUri_s", ""))), Client=tostring(column_ifexists("clientIP_s", "")), Action=tostring(column_ifexists("action_s", ""))
| where Uri has "accesson.php" or Uri has "custom_options/quote" or Uri has "customer_address"
| project TimeGenerated, ResourceId, Category, Client, Uri, Action
| order by TimeGenerated desc

Hunt 04 — New PHP webshell files in Magento writable media paths

DeviceFileEvents
| where TimeGenerated > ago(30d)
| where ActionType in~ ("FileCreated","FileModified","FileRenamed")
| where FolderPath has_any ("custom_options","customer_address") and FolderPath has "media"
| where FileName endswith ".php" or FileName =~ "accesson.php" or FileName endswith ".phtml"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ActionType, FileName, FolderPath, SHA256
| order by TimeGenerated desc

Hunt 05 — Webserver spawning shell or download utility on storefront hosts

DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("php-fpm","php-fpm8.2","php-fpm8.3","php-fpm8.4","php.exe","httpd","httpd.exe","apache2","nginx")
| where FileName in~ ("sh","bash","dash","curl","wget","python3","nc","ncat","cmd.exe","powershell.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

Hunt 06 — Forwarded Magento CMS-block loader content or webshell messages

Syslog
| where TimeGenerated > ago(30d)
| where SyslogMessage has_any ("deepveindrilling.com","fpCode","se_referrer","accesson.php","additionalver.com","localStorage.getItem")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

Hunt 07 — Public web proxy traffic to reported payload destinations

CommonSecurityLog
| where TimeGenerated > ago(90d)
| extend Host=tolower(tostring(DestinationHostName)), Url=tolower(tostring(RequestURL))
| where Host has_any ("leqdger.click","crypto-insider.top") or Url has_any ("leqdger.click","crypto-insider.top")
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestURL, DeviceAction
| order by TimeGenerated desc

Hunt 08 — Windows 4688 fallback for webshell-like PHP process chains

SecurityEvent
| where TimeGenerated > ago(30d) and EventID == 4688
| where ParentProcessName has_any ("php.exe","httpd.exe","nginx.exe")
| where NewProcessName has_any ("cmd.exe","powershell.exe","certutil.exe","bitsadmin.exe")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc

Detection Notes

Highest signal: traffic to current deepveindrilling.com, a PHP file newly created under pub/media/custom_options/quote/ or pub/media/customer_address/, or a request for accesson.php on a Magento host. Expected noise: legitimate media uploads, PHP maintenance and outbound e-commerce integrations. Sansec's fpCode, se_referrer and localStorage.getItem strings live in CMS database content; they are not normally visible in Sentinel without custom database or application logs. The final October payload was not captured; do not invent a card-skimming payload hash. Previously expired domains may now be parked or controlled by others; correlate older IOC hits with date and context. CommonSecurityLog may not include full HTTP URLs, and Device* queries require endpoint ingestion. Magento presence is not inferred from network compatibility.

Leave a Reply