Thursday, April 17, 2025
HomeCVE/vulnerabilityHackers Attacking WebLogic Servers via CVE-2020–14882 Flaw to install Cobalt Strike Malware

Hackers Attacking WebLogic Servers via CVE-2020–14882 Flaw to install Cobalt Strike Malware

Published on

SIEM as a Service

Follow Us on Google News

Attackers are found to be exploiting Oracle WebLogic Servers via CVE-2020–14882 to install Cobalt Strike which will allow persistent remote access to the compromised devices.

Testing the vulnerability

The latter half of last week saw a flurry of scans against Oracle’s WebLogic Server to check the vulnerability of CVE-2020-14882.

It is important to note that CVE-2020-14882 was patched a couple of weeks back and this was covered by us in great detail.

- Advertisement - Google News

In addition to the scans searching for vulnerabilities, it was found to be a few attempting to install crypto-mining tools.

On Friday, Oracle amended its patch for CVE-2020–14882 [2]. A new variation of the vulnerability (CVE-2020–14750) can be used to exploit WebLogic servers with a trivial modification of the exploit code.

What is a Cobalt Strike?

Cobalt Strike is a legitimate penetration testing tool that is used by threat actors in the post-exploitation tasks and to deploy beacons that enable them to gain continuous remote access.

This later allows them to access the compromised servers to harvest data and to deploy the second stage of malware payloads.

How did the attack happen?

The attackers are using a chain of base64-encoded Powershell scripts to download and install Cobalt Strike payloads on unpatched Oracle WebLogic servers.

Cobalt Strike is normally used to detect system penetration but though the tool is intended to do good, cybercriminals have used this tool for malicious intents and purposes.

The Cisco Talos Q4 2020 CTIR report states that of all the ransomware attacks this quarter, 66% of them involved the use of Cobalt Strike

The result of this operation is a shellcode to download and execute a Cobalt Strike payload.

Cobalt Strike deployment

Immediate Action advised

As both CVE-2020-14882 and CVE-2020-14750 can easily be exploited by unauthenticated attackers to take over vulnerable WebLogic servers, Oracle advises companies to immediately apply the security updates to block attacks.

The Cybersecurity and Infrastructure Security Agency (CISA) also urged administrators to apply the security update as soon as possible to address the two critical vulnerabilities.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Ransomware Attacks Surge 126%, Targeting Consumer Goods and Services Sector

The cybersecurity landscape witnessed a dramatic escalation in ransomware attacks, marking a concerning trend...

CrazyHunter Hacker Group Exploits Open-Source GitHub Tools to Target Organizations

A relatively new ransomware outfit known as CrazyHunter has emerged as a significant threat,...

Threat Actors Leverage Cascading Shadows Attack Chain to Evade Detection and Hinder Analysis

A sophisticated multi-layered phishing campaign was uncovered, employing a complex attack chain known as...

Microsoft Vulnerabilities Reach Record High with Over 1,300 Reported in 2024

The 12th Edition of the Microsoft Vulnerabilities Report has revealed a significant surge in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Critical Erlang/OTP SSH Vulnerability Allow Hackers Execute Arbitrary Code Remotely

A major security flaw has been uncovered in the widely used Erlang/OTP SSH implementation,...

CISA Warns of Potential Credential Exploits Linked to Oracle Cloud Hack

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a public warning following reports...

Critical Flaw in PHP’s extract() Function Enables Arbitrary Code Execution

A critical vulnerability in PHP’s extract() function has been uncovered, enabling attackers to execute arbitrary code...