Thursday, November 14, 2024
HomeCryptocurrency hackOracle Weblogic Exploit to Deploy Monero Miner

Oracle Weblogic Exploit to Deploy Monero Miner

Published on

Malware protection

Oracle WebLogic application server is vulnerable to cryptocurrency mining.The security researcher has found this exploit to mine monero coins in the compromised machine.

This critical bug allows hackers to run arbitrary commands with WebLogic server with user privileges.

The vulnerability (CVE 2017-10271) was present in the WebLogic Web Services component (wls-wsat) and due to lack of improperly user input sanitizing which allow an unauthenticated remote attacker to install and run crypto miners and hijacking their processing power to mine Monero coins makes the spike in CPU usage.

- Advertisement - SIEM as a Service

The attackers begun using Chinese security researcher Lian Zhang published a proof-of-concept exploit in December, says Johannes Ullrich, dean of research for SANS Technology Institute.

Also Read: CoffeeMiner – Hacking into WiFi Networks to Inject Cryptocurrency Miners

Ullrich explains Crypto mining relies on lots of processing power generated by computers, servers, and even mobile devices, to mine cryptocurrency.

The attackers use Dropper script which checks for the Web Services while accessing the URL <HOST>/wls-wsat/CoordinatorPortType, then dropped script download the miner and executes it.intentionally kills the Weblogic service on the target.check figure

The script downloads the miner and executes it and intentionally kills the Weblogic service on the target.

The attackers using this exploit  to launch crypto miners on PeopleSoft, WebLogic app servers and Amazon cloud environments that were tied to WebLogic app servers, Ullrich says

According to Ullrich, the miner software being used in the campaign is xmrig, which is a legitimate crypto coin miner for Monero.

According to SANS threat list cryptocurrencies, miners in your network can be found out by correlating the network traffic which contains IP addresses.

Ullrich said finally “It is very likely that more sophisticated attackers used this to gain a persistent foothold on the system. In this case, the only ‘persistence’ we noticed was the CRON job. But there are many more – and more difficult to detect – ways to gain persistence.”

The indicators for this specific campaign includes:

IOCs (Indicators of Compromise)

Network

hxxp://165.227.215.25/
hxxp://165.227.215.25/xmrig-y
hxxps://165.227.215.25/xmrig-y
hxxp://165.227.215.25/java_infected
hxxp://165.227.215.25/xmrig-y%20$mName
hxxp://165.227.215.25/5555
hxxp://165.227.215.25/xmrig-aeon.exe
hxxp://165.227.215.25/xmrig-y.exe
hxxp://165.227.215.25/xmrig-y%20$
hxxp://165.227.215.25/xmrig

Hashes (MD5) Monero Miner

0e0ad37bc72453e4ec2a6029517a8edd
44d3ea4f3542f246a5535c9f114fbb09

Latest articles

Windows 0-Day Exploited in Wild with Single Right Click

A newly discovered zero-day vulnerability, CVE-2024-43451, has been actively exploited in the wild, targeting Windows...

Automating Identity and Access Management for Modern Enterprises

Keeping track of who has access and managing their permissions has gotten a lot...

Finding The Right E-Commerce Platform – Comparing Reselling Solutions

If you’re looking to make some extra cash or to start a business, you...

Fortinet Patches Critical Flaws That Affected Multiple Products

Fortinet, a leading cybersecurity provider, has issued patches for several critical vulnerabilities impacting multiple...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

New Android Malware SpyAgent Taking Screenshots Of User’s Devices

SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases...

North Korean Hackers Employing New Tactic To Acruire Remote Jobs

North Korean threat actors behind the Contagious Interview and WageMole campaigns have refined their...

Critical Atlassian Vulnerability Exploited To Connect Servers In Mining Networks

Hackers usually shift their attention towards Atlassian due to flaws in its software, especially...