Vulnerabilitycritical

8220 gang exploits old Oracle WebLogic vulnerability to deliver infostealers, cryptominers

Help Net Securityby @helpnetsecurityDec 20, 2023 · 00:00 UTC (Dec 20, 2023)1 min read2 · 2 reads

Read at helpnetsecurity.com

Analyze CVE-2020-14883 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2020-14883 CVE-2017-3506 CVE-2020-14882

Tags: cve-2020-14883 cve-2017-3506 cve-2020-14882 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2017-3506	Unauthenticated OS Command Injection in Oracle WebLogic Server	7.4	96%	KEV	Apr 24, 2017 KEV Jun 3, 2024
CVE-2020-14882 +1 related CVE CVE-2020-14883	Remote Code Execution in Oracle WebLogic Server	9.8 group max	100%	KEVPoC ×3	Oct 21, 2020 KEV Nov 3, 2021

From the original article

1 min read at helpnetsecurity.com

The 8220 gang has been leveraging an old Oracle WebLogic Server vulnerability (CVE-2020-14883) to distribute malware, the Imperva Threat Research team has found. Active since 2017, the 8220 gang has been known for deploying cryptocurrency miners on Linux and Windows hosts by exploiting known vulnerabilities.

Help Net Security

By @helpnetsecurity · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.