Threat actorhigh
A long-running cryptomining campaign conducted by 8220 hackers now targets Linux servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-2725 | Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-26134 | Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | jira.letmaker.top | ss to a target system, an evasive loader is downloaded from jira[.]letmaker[.]top. The loader eludes detection by clearing log files and |
| sha256 | 2bd102ddc0e618d91a7adc3f3fb92fcfb258680f11b904bb129f5f2f918dcc5f | dfca291533a544b8f58c1e6e30dcd46e3b58bf38e5 (loader script); 2bd102ddc0e618d91a7adc3f3fb92fcfb258680f11b904bb129f5f2f918dcc5f (PwnRig miner for i686); ca7fb4ee975499b2b1497fb1be69d0187d |
| sha256 | bd3c7a55ee04d5713eaf36dfca291533a544b8f58c1e6e30dcd46e3b58bf38e5 | ors of compromise (IoCs) for this campaign. IoCs (SHA-256): bd3c7a55ee04d5713eaf36dfca291533a544b8f58c1e6e30dcd46e3b58bf38e5 (loader script); 2bd102ddc0e618d91a7adc3f3fb92fcfb258680f11 |
| sha256 | ca7fb4ee975499b2b1497fb1be69d0187d0a5cf83a2a646ad2855f4e739c8326 | cfb258680f11b904bb129f5f2f918dcc5f (PwnRig miner for i686); ca7fb4ee975499b2b1497fb1be69d0187d0a5cf83a2a646ad2855f4e739c8326 (pwnRig for x86_64) — Microsoft Threat Intelligence (@MsftS |
From the original article
2 min read at securityaffairs.com
Microsoft spotted a cloud threat actor tracked as 8220 that is now targeting Linux servers in a long-running cryptomining campaign. Microsoft Security Intelligence experts are warning of a long-running campaign conducted by a cloud threat actor group, tracked as 8220, that is now targeting Linux servers to install crypto miners.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.