StyleSmuggler 0-Day (CVE-2025-54236): Unauthenticated RCE Campaign Against Magento & Adobe Commerce — OTX Pulse Analysis + Detection Pack

---
title: StyleSmuggler - Web Server Process Spawning Suspicious Child Process
description: Detects PHP-FPM/Apache/Nginx spawning shells or interpreters, consistent with post-exploitation after CVE-2025-54236 RCE on Magento/Adobe Commerce
status: experimental
logsource:
  category: process_creation
  product: linux
author: Security Arsenal Threat Intelligence
date: 2026/09/08
references:
  - https://sansec.io/research/stylesmuggler
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Magento cron jobs invoking shell wrappers (review CommandLine for cron.php context)
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
---
title: StyleSmuggler - PHP File Written to Magento Web-Accessible Directories
description: Detects creation of PHP files in web root, pub/media, or template directories by web server processes - a hallmark of StyleSmuggler backdoor deployment
status: experimental
logsource:
  category: file_event
  product: linux
author: Security Arsenal Threat Intelligence
date: 2026/09/08
references:
  - https://sansec.io/research/stylesmuggler
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/www/html/pub/media/'
      - '/pub/static/'
      - '/app/code/'
      - '/app/design/'
      - '/var/view_preprocessed/'
      - '/generated/code/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  filter_known:
    Image|endswith:
      - '/composer'
      - '/bin/magento'
  condition: selection_path and selection_ext and not filter_known
falsepositives:
  - Legitimate deployments, module installations, cache generation
level: high
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1190
---
title: StyleSmuggler - Beaconing to Campaign C2 Infrastructure
description: Detects network connections or DNS queries to known StyleSmuggler C2 and staging infrastructure identified in OTX pulse data
status: experimental
logsource:
  category: network_connection
author: Security Arsenal Threat Intelligence
date: 2026/09/08
references:
  - https://sansec.io/research/stylesmuggler
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'windwsecurity.run'
      - 'ntp.timesysnc.net'
  condition: selection_domain
falsepositives:
  - Unlikely; both indicators are typosquat/staging domains
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1071.001

// StyleSmuggler (CVE-2025-54236) Hunt — Magento/Adobe Commerce RCE + C2
// Coverage: C2 beaconing, web shell deployment, web server process anomalies
let lookback = 14d;
let c2_indicators = dynamic(["windwsecurity.run", "ntp.timesysnc.net", "ecomscan.com"]);
let payload_hashes = dynamic([
  "b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420",
  "e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7"
]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any (c2_indicators)
   or RemoteUrl contains "timesysnc"
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend HuntHit = "C2_Beacon";
let FileHits = DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where SHA256 in (payload_hashes)
   or (FolderPath has_any ("/pub/media/", "/pub/static/", "/var/view_preprocessed/", "/app/code/")
       and FileName endswith ".php")
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName
| extend HuntHit = "Backdoor_File";
let ProcessHits = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName has_any ("php-fpm", "apache2", "httpd", "nginx")
| where FileName has_any ("sh", "bash", "curl", "wget", "python", "nc", "base64", "perl")
| where ProcessCommandLine !contains "cron.php"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| extend HuntHit = "WebShell_Execution";
union NetworkHits, FileHits, ProcessHits
| sort by TimeGenerated desc

# StyleSmuggler (CVE-2025-54236) IOC Hunt Script — Security Arsenal
# Run on suspected Magento/Adobe Commerce web servers (Windows/IIS-hosted or jump hosts)
# For Linux hosts, see the bash equivalent below in comments.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "[+] StyleSmuggler IOC Hunt — $(Get-Date)" -ForegroundColor Cyan

# --- 1. Check DNS cache for C2 indicators ---
Write-Host "[*] Checking DNS cache for StyleSmuggler C2..." -ForegroundColor Yellow
$c2 = @('windwsecurity.run','ntp.timesysnc.net','ecomscan.com')
$dns = Get-DnsClientCache
foreach ($ioc in $c2) {
    $hits = $dns | Where-Object { $_.Entry -like "*$ioc*" }
    if ($hits) {
        $report += [PSCustomObject]@{Check='DNS_Cache'; IOC=$ioc; Result="HIT — $($hits.Entry -join ', ')"; Severity='CRITICAL'}
        Write-Host "  [!] DNS HIT: $ioc" -ForegroundColor Red
    }
}

# --- 2. Hunt for payload hashes across web roots ---
Write-Host "[*] Hashing files in common web roots (may take time)..." -ForegroundColor Yellow
$targetHashes = @(
    'b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420',
    'e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7',
    'a07bc08eded18cc7317216cbbd7032d2'
)
$webRoots = @('C:\inetpub\wwwroot','C:\xampp\htdocs','D:\www','/var/www/html')
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -File -Include *.php,*.phtml,*.phar,*.php5 -ErrorAction SilentlyContinue |
          ForEach-Object {
            $sha = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            $md5 = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
            if ($targetHashes -contains $sha -or $targetHashes -contains $md5) {
                $report += [PSCustomObject]@{Check='File_Hash'; IOC=$sha; Result="HIT — $($_.FullName)"; Severity='CRITICAL'}
                Write-Host "  [!] MALICIOUS FILE: $($_.FullName)" -ForegroundColor Red
            }
          }
    }
}

# --- 3. Hunt for recently created PHP files (backdoor deployment window) ---
Write-Host "[*] Scanning for PHP files modified since exploitation began (2026-09-04)..." -ForegroundColor Yellow
$exploitStart = Get-Date '2026-09-04'
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -File -Include *.php,*.phtml -ErrorAction SilentlyContinue |
          Where-Object { $_.LastWriteTime -gt $exploitStart } |
          ForEach-Object {
            $report += [PSCustomObject]@{Check='Recent_PHP'; IOC=$_.FullName; Result="Modified $($_.LastWriteTime)"; Severity='REVIEW'}
          }
    }
}

# --- 4. Check active network connections to suspicious domains ---
Write-Host "[*] Checking active connections..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established |
  Where-Object { $_.RemotePort -in 80,443,53,123 } |
  ForEach-Object {
    $rdns = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName
    foreach ($ioc in $c2) {
        if ($rdns -like "*$ioc*") {
            $report += [PSCustomObject]@{Check='Active_Connection'; IOC=$ioc; Result="$($_.RemoteAddress) ($rdns) PID $($_.OwningProcess)"; Severity='CRITICAL'}
        }
    }
  }

# --- 5. Audit local admin accounts (post-exploitation persistence) ---
Write-Host "[*] Auditing recently created local users..." -ForegroundColor Yellow
Get-LocalUser | Where-Object { $_.Created -gt $exploitStart } |
  ForEach-Object {
    $report += [PSCustomObject]@{Check='New_Local_User'; IOC=$_.Name; Result="Created $($_.Created)"; Severity='HIGH'}
  }

# --- Output ---
Write-Host "`n[+] Hunt complete. $($report.Count) findings." -ForegroundColor Cyan
$report | Format-Table -AutoSize
$report | Export-Csv -Path "StyleSmuggler_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation

# Linux bash equivalent for hash hunt:
# find /var/www/html -type f \( -name '*.php' -o -name '*.phtml' \) -newermt 2026-09-04 -exec sha256sum {} \; | grep -Ei 'b79dfdc1|e315687a'
# grep -rEi 'windwsecurity\.run|timesysnc\.net' /var/log/{apache2,nginx,syslog}/ 2>/dev/null