8220 Gang Exploits Oracle WebLogic Server Flaws for Cryptocurrency Mining
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-3506 | Unauthenticated OS Command Injection in Oracle WebLogic Server CVE-2017-3506 is an unauthenticated operating system command injection flaw (CWE-78) in the Web Services subcomponent of Oracle WebLogic Server. A remote attacker with network access over HTTP can trigger it, though the flaw is rated difficult to exploit (high attack complexity). Successful exploitation allows the attacker to create, delete, or modify critical data and gain unauthorized access to critical data — potentially all data accessible to WebLogic Server — without authentication, with no availability impact. Organizations running affected versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, or 12.2.1.2 are exposed, especially where the HTTP interface is internet-reachable. The flaw is under active attack: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-06-03, EPSS is at 96.3%, and the 8220 gang is exploiting it to deliver infostealers and cryptocurrency miners. Do: Apply the Oracle Critical Patch Update from April 2017 or later (or upgrade WebLogic Server to a patched, supported release), consistent with CISA's KEV required action to apply vendor mitigations or discontinue use. Until patched, restrict network access to the Web Services HTTP interface. Hunt affected servers for 8220 gang activity — unexpected child processes, cryptomining loads, and infostealer artifacts — since exploitation requires no authentication. | 7.4 | 96% | KEV |
| largetens of thousands (≈10k–100k) of internet-exposed WebLogic servers; substantially more when internal enterprise deployments are counted | |
| CVE-2023-21839 | Unauthenticated Remote Code Execution in Oracle WebLogic Server via T3/IIOP Oracle WebLogic Server contains a vulnerability that allows an unauthenticated attacker with network access to the server's T3 or IIOP endpoints to fully compromise the WebLogic instance (widely characterized as remote code execution). It is triggered simply by sending crafted T3 or IIOP protocol requests to a listening WebLogic server, requiring no credentials or user interaction. An attacker who succeeds gains the ability to run code on the application server host, providing a foothold in the application tier that can be used for lateral movement; CISA notes that ransomware use is currently unknown. Any organization running affected Oracle WebLogic Server versions is exposed, particularly where the T3/IIOP listeners are reachable from the internet or from less-trusted network zones. The flaw is being exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-05-01, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile). Do: Apply the Oracle Critical Patch Update that fixes CVE-2023-21839 (January 2023 CPU) to WebLogic Server per Oracle's instructions, prioritizing internet-facing systems given the KEV listing. Restrict network access to the T3 (default TCP 7001) and IIOP listeners to trusted hosts only, and check exposed servers for signs of compromise. Ransomware linkage is unknown, so treat all affected instances as patch-priority rather than only ransomware-targeted ones. | 7.5 | 100% | KEV PoC |
| largetens of thousands (≈10,000–40,000) of internet-exposed WebLogic servers, with a far larger internal installed base |
Full article378 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 28, 2024Malware / Cryptocurrency
Security researchers have shed more light on the cryptocurrency mining operation conducted by the 8220 Gang by exploiting known security flaws in the Oracle WebLogic Server.
"The threat actor employs fileless execution techniques, using DLL reflective and process injection, allowing the malware code to run solely in memory and avoid disk-based detection mechanisms," Trend Micro researchers Ahmed Mohamed Ibrahim, Shubham Singh, and Sunil Bharti said in a new analysis published today.
The cybersecurity firm is tracking the financially motivated actor under the name Water Sigbin, which is known to weaponize vulnerabilities in Oracle WebLogic Server such as CVE-2017-3506, CVE- 2017-10271, and CVE-2023-21839 for initial access and drop the miner payload via a multi-stage loading technique.
A successful foothold is followed by the deployment of PowerShell script that's responsible for dropping a first-stage loader ("wireguard2-3.exe") that mimics the legitimate WireGuard VPN application, but, in reality, launches another binary ("cvtres.exe") in memory by means of a DLL ("Zxpus.dll").
The injected executable serves as a conduit to load the PureCrypter loader ("Tixrgtluffu.dll") that, in turn, exfiltrates hardware information to a remote server and creates scheduled tasks to run the miner as well as excludes the malicious files from Microsoft Defender Antivirus.
In response, the command-and-control (C2) server responds with an encrypted message containing the XMRig configuration details, following which the loader retrieves and executes the miner from an attacker-controlled domain by masquerading it as "AddinProcess.exe," a legitimate Microsoft binary.
The development comes as the QiAnXin XLab team detailed a new installer tool used by the 8220 Gang called k4spreader since at least February 2024 to deliver the Tsunami DDoS botnet and the PwnRig mining program.
The malware, which is currently under development and has a shell version, has been leveraging security flaws such as Apache Hadoop YARN, JBoss, and Oracle WebLogic Server to infiltrate susceptible targets.
"k4spreader is written in cgo, including system persistence, downloading and updating itself, and releasing other malware for execution," the company said, adding it's also designed to disable the firewall, terminate rival botnets (e.g., kinsing), and printing operational status.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/06/8220-gang-exploits-oracle-weblogic.html