Threats tagged 'chi_down'

Between September 9 and 13, 2026, a coordinated campaign exploited Magento and Adobe Commerce stores globally using CVE-2026-75650 (StyleSmuggler). The attackers delivered a shell-script dropper, PSK Agent RAT, and PHP webshell via the /paypal/transparent/response/ endpoint. The dropper had 0% detection on VirusTotal at analysis time. The campaign also deployed chi_down, an obfuscated Go binary with remote access capabilities including command execution, SOCKS5 proxying, and encrypted communications. DNS exfiltration was used to track successful compromises. Chinese-language comments and infrastructure naming suggest a likely Chinese-speaking operator, though no specific threat group attribution is confirmed. Multiple operators are exploiting the same vulnerability with different toolkits.