Cybercriminals Targeting Apache NiFi Instances for Cryptocurrency Mining
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-14882 +1 in the same advisory: …14883 | Remote Code Execution in Oracle WebLogic Server CVE-2020-14882 is a remote code execution vulnerability in Oracle WebLogic Server; its relationship to CVE-2020-14750 (a WebLogic administration console flaw) indicates it is reachable over the network, likely without authentication. An attacker who can reach a vulnerable WebLogic instance can trigger the flaw and execute arbitrary code in the context of the server. Successful exploitation can yield full control of the affected host, enabling data theft, lateral movement, and potentially ransomware deployment (ransomware use is currently unknown). Any organization running Oracle WebLogic Server is affected; WebLogic is widely deployed as a Java application server in large enterprises and government networks, and instances are frequently exposed to the internet. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a maximum EPSS score of 100%, indicating confirmed in-the-wild exploitation. Do: Apply Oracle's WebLogic Server updates per vendor instructions immediately, as this is a required action under the CISA KEV listing. Inventory environments for WebLogic deployments (commonly listening on ports 7001/7002), prioritize patching internet-facing instances, and restrict or firewall access to the WebLogic administration console until patched. Review access logs for signs of exploitation, and treat unpatched, externally reachable WebLogic servers as high risk given the 100% EPSS score and confirmed in-the-wild exploitation. | 9.8 group max | 100% | KEV PoC ×3 |
| large≈50,000–100,000 internet-exposed WebLogic systems (public internet-wide scan counts around 2020); many more deployed internally in enterprise networks |
Full article330 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 31, 2023Server Security / Cryptocurrency
A financially motivated threat actor is actively scouring the internet for unprotected Apache NiFi instances to covertly install a cryptocurrency miner and facilitate lateral movement.
The findings come from the SANS Internet Storm Center (ISC), which detected a spike in HTTP requests for “/nifi” on May 19, 2023.
“Persistence is achieved via timed processors or entries to cron,” said Dr. Johannes Ullrich, dean of research for SANS Technology Institute. “The attack script is not saved to the system. The attack scripts are kept in memory only.”
A honeypot setup allowed the ISC to determine that the initial foothold is weaponized to drop a shell script that removes the “/var/log/syslog” file, disables the firewall, and terminates competing crypto-mining tools, before downloading and launching the Kinsing malware from a remote server.
It’s worth pointing out that Kinsing has a track record of leveraging publicly disclosed vulnerabilities in publicly accessible web applications to carry out its attacks.
In September 2022, Trend Micro detailed an identical attack chain that utilized old Oracle WebLogic Server flaws (CVE-2020-14882 and CVE-2020-14883) to deliver the cryptocurrency mining malware.
Select attacks mounted by the same threat actor against exposed NiFi servers also entail the execution of a second shell script that’s designed to collect SSH keys from the infected host to connect to other systems within the victim’s organization.
A notable indicator of the ongoing campaign is that the actual attack and scanning activities are carried out via the IP address 109.207.200[.]43 against port 8080 and port 8443/TCP.
“Due to its use as a data processing platform, NiFi servers often have access to business-critical data,” SANS ISC said. “NiFi servers are likely attractive targets as they are configured with larger CPUs to support data transformation tasks. The attack is trivial if the NiFi server is not secured.”
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/05/cybercriminals-targeting-apache-nifi.html