Wednesday, May 22, 2024

Oracle Weblogic Exploit to Deploy Monero Miner

Oracle WebLogic application server is vulnerable to cryptocurrency mining.The security researcher has found this exploit to mine monero coins in the compromised machine.

This critical bug allows hackers to run arbitrary commands with WebLogic server with user privileges.

The vulnerability (CVE 2017-10271) was present in the WebLogic Web Services component (wls-wsat) and due to lack of improperly user input sanitizing which allow an unauthenticated remote attacker to install and run crypto miners and hijacking their processing power to mine Monero coins makes the spike in CPU usage.

The attackers begun using Chinese security researcher Lian Zhang published a proof-of-concept exploit in December, says Johannes Ullrich, dean of research for SANS Technology Institute.

Also Read: CoffeeMiner – Hacking into WiFi Networks to Inject Cryptocurrency Miners

Ullrich explains Crypto mining relies on lots of processing power generated by computers, servers, and even mobile devices, to mine cryptocurrency.

The attackers use Dropper script which checks for the Web Services while accessing the URL <HOST>/wls-wsat/CoordinatorPortType, then dropped script download the miner and executes it.intentionally kills the Weblogic service on the target.check figure

The script downloads the miner and executes it and intentionally kills the Weblogic service on the target.

The attackers using this exploit  to launch crypto miners on PeopleSoft, WebLogic app servers and Amazon cloud environments that were tied to WebLogic app servers, Ullrich says

According to Ullrich, the miner software being used in the campaign is xmrig, which is a legitimate crypto coin miner for Monero.

According to SANS threat list cryptocurrencies, miners in your network can be found out by correlating the network traffic which contains IP addresses.

Ullrich said finally “It is very likely that more sophisticated attackers used this to gain a persistent foothold on the system. In this case, the only ‘persistence’ we noticed was the CRON job. But there are many more – and more difficult to detect – ways to gain persistence.”

The indicators for this specific campaign includes:

IOCs (Indicators of Compromise)

Network

hxxp://165.227.215.25/
hxxp://165.227.215.25/xmrig-y
hxxps://165.227.215.25/xmrig-y
hxxp://165.227.215.25/java_infected
hxxp://165.227.215.25/xmrig-y%20$mName
hxxp://165.227.215.25/5555
hxxp://165.227.215.25/xmrig-aeon.exe
hxxp://165.227.215.25/xmrig-y.exe
hxxp://165.227.215.25/xmrig-y%20$
hxxp://165.227.215.25/xmrig

Hashes (MD5) Monero Miner

0e0ad37bc72453e4ec2a6029517a8edd
44d3ea4f3542f246a5535c9f114fbb09

Website

Latest articles

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...

DoppelGänger Attack: Malware Routed Via News Websites And Social Media

A Russian influence campaign, DoppelGänger, leverages fake news websites (typosquatted and independent) to spread...

Critical Memory Corruption In Cloud Logging Infrastructure Enables Code Execution Attack

A new critical vulnerability has been discovered in Fluent Bit's built-in HTTP server, which...

Microsoft Unveild New Windows 11 Features To Strengthen Security

Microsoft has been prioritizing security in Windows, as they introduced Secured-Core PCs to protect...

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles