A backdoor deployed against Adobe Commerce and Magento stores has been hiding its Command-and-Control (C2) traffic inside packets shaped like time synchronization. On some hosts it has relaunched under the name of the legitimate Linux time daemon, according to Sansec.
In a technical write-up published Sept. 5 and last updated Sept. 7, the Dutch e-commerce security firm said it saw the implant in attacks exploiting CVE-2026-75650, the zero-day Sansec named StyleSmuggler.
Adobe hotfixed the flaw on Sept. 7, three days after the first confirmed exploitation, covering versions 2.4.4 to 2.4.9 and rating it at CVSS 10.0.
The traffic is built to pass as time sync. It sends 48-byte UDP packets to port 123 from hosts named like NTP infrastructure, only the first four bytes conforming to the protocol, the rest carrying chunked MessagePack data about the host and the implant.
Sansec said the traffic passes most egress filtering unremarked. Behavior is the better signal: a real client sends one datagram, while the implant emits nine about 10 milliseconds apart every 60 seconds, each marked as NTPv4 server mode.
Server mode marks a packet as a reply rather than a request, so outbound traffic carrying it is answering a question nobody asked.
The implant first ran as a kernel worker thread, then as fc-cache, and on Sept. 7 relaunched as chronyd, the real NTP daemon on most Linux distributions. The agent identifier carried over and its parent was PID 1, so Sansec treated the rename as self-initiated rather than a second infection.
The Rename Defeats the Obvious Hunt
That is the point of the name. Sansec said anyone filtering UDP port 123 will exclude chronyd as the legitimate time daemon, and that the exclusion hides the build completely.
Persistence varied between hosts. A second merchant saw a chronyd binary that did install a cron entry, written into the spool file rather than through crontab and leaving no syslog record, so an empty crontab proves nothing.
Until the hotfix, being current was no protection. Sansec reproduced the chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9, and said its first victim ran 2.4.6-p15 with the July and August patches applied and a clean patch-status check. The company has no indication the backdoor has been weaponized.
Adobe is telling merchants to rotate the encryption key and everything it protected, a list running from admin passwords and integration tokens to payment gateway credentials, database logins and deploy keys.
Sansec added that those should be changed at the source rather than only inside Magento, because rotating the key on its own does nothing about what an attacker has already read.
Image credit: Sansec
