Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url:
As i am maintaining their environment when i saw that link i was curious what is that. When i opened that link it first attempt it showed some JS related encrypted code so i got some doubt about it.
Did perform scan in tools like sucuri and foregenix to verify site is malware infected. Both scanner showed result clean but when i ran http://write-cdn.com/ in sucuri it gave me red alert that domain is blacklisted for malware activities.
I removed that code from mysite and performed Db scan by checking blocks, pages, core_config_data and few other tables. did check code using grep linux command to find out but didn't find any clue.
I want to know how that code injected in site. I did check admin logs, magento logs, nginx logs. Also created magento support ticket but those guys just useless and giving zero information how someone entered that code. admin access is shared with 2 person and all have secure and 20 character special character password.
Is there any way i can track from where that malware code came?
Is there any tool or way i can quickly scan and monitor for magento?
Is there any way i check who changed into db directly like logging or something?
Any help would be appreciated.