Mikrotik Router Breach, REVSTEALER Crypto Miner, Magento Vulnerability

Recent alerts detail Mikrotik routers hijacked through exposed SSH, a new REVSTEALER crypto‑miner module disabling Windows Update and Defender, and an unpatched Magento/Adobe Commerce zero‑day enabling server backdoors.

Mikrotik router attackers have exploited the internet‑exposed Secure Shell (SSH) service without authentication. CERT Polska issued a warning on September 5, noting attacks had occurred as early as September 2. The vulnerability stems from leaving default credentials active; many small businesses keep the default password unchanged, allowing remote control with no further verification. Similar exploits by Chinese APT groups such as G00612 target Southeast Asia since 2019, often moving laterally before exfiltrating data via DNS tunneling over HTTPS channels that are hard for firewalls to detect without deep packet inspection. Prompt patching mitigates this risk but requires careful planning of network downtime when multiple routers must be updated simultaneously across geographically distributed locations. ¹

Elastic Security Labs documented four previously unreported programs linked to the REVSTEALER information stealer. After the main stealer deletes itself, these modules remain on infected machines: ProManager, WinUpdate, and SoftManager. They disable Windows Update and Microsoft Defender before launching a cryptocurrency miner, preventing security patches and detection by standard AV tools. Written in C#, they mirror techniques used by Zeus banking trojan in 2009, illustrating how modern stealers evolve into multi‑purpose threats. ¹

Sansec’s advisory published on September 5 describes an unpatched zero‑day flaw in Magento Open Source and Adobe Commerce that lets attackers run malicious code on a store’s server without logging in. The company named the vulnerability StyleSmuggler; attacks began on September 4. The flaw involves injecting malicious code directly within CSS files, which can then execute server side through cross‑site scripting (XSS) vulnerabilities. Stolen customer data from compromised e‑commerce sites feeds identity theft rings such as Magecart groups operating since about 2018. ¹