New HolesWarm botnet targets Windows and Linux servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-14882 | Remote Code Execution in Oracle WebLogic Server CVE-2020-14882 is a remote code execution vulnerability in Oracle WebLogic Server; its relationship to CVE-2020-14750 (a WebLogic administration console flaw) indicates it is reachable over the network, likely without authentication. An attacker who can reach a vulnerable WebLogic instance can trigger the flaw and execute arbitrary code in the context of the server. Successful exploitation can yield full control of the affected host, enabling data theft, lateral movement, and potentially ransomware deployment (ransomware use is currently unknown). Any organization running Oracle WebLogic Server is affected; WebLogic is widely deployed as a Java application server in large enterprises and government networks, and instances are frequently exposed to the internet. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a maximum EPSS score of 100%, indicating confirmed in-the-wild exploitation. Do: Apply Oracle's WebLogic Server updates per vendor instructions immediately, as this is a required action under the CISA KEV listing. Inventory environments for WebLogic deployments (commonly listening on ports 7001/7002), prioritize patching internet-facing instances, and restrict or firewall access to the WebLogic administration console until patched. Review access logs for signs of exploitation, and treat unpatched, externally reachable WebLogic servers as high risk given the 100% EPSS score and confirmed in-the-wild exploitation. | 9.8 | 100% | KEV PoC ×3 |
| large≈50,000–100,000 internet-exposed WebLogic systems (public internet-wide scan counts around 2020); many more deployed internally in enterprise networks |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | m.windowsupdatesupport.org | arily operated from a command and control server located at m[.]windowsupdatesupport[.]org , the botnet has been seen exploiting vulnerabilities i |
Full article331 words · extracted from therecord.media · click to collapse
A new botnet named HolesWarm has been slowly growing in the shadows since June this year, exploiting more than 20 known vulnerabilities to break into Windows and Linux servers and then deploy cryptocurrency-mining malware. While attacks have primarily been spotted across China, with reports from security firm Tencent and various IT bloggers, the botnet is expected to expand its reach, and target systems across the globe as its infrastructure and attack capabilities expand in the coming months. Primarily operated from a command and control server located at m[.]windowsupdatesupport[.]org, the botnet has been seen exploiting vulnerabilities in software such as: While the entry vectors may vary per victim, Tencent Security says that once the malware gets a foothold on an infected system, HolesWarm dumps local passwords, expands to the local network, and then deploys an XMRig-based cryptocurrency mining tool. While other botnet operators try to hide their presence on infected systems by tethering the crypto-mining process, HolesWarm doesn't appear to employ this safety mechanism, and per several reports, the botnet often maxs out server CPUs, leading to its discovery. Right now, the botnet is just the latest in a long line of crypto-mining botnets that are popping up online on a regular basis. Nothing in its make-up screams technical sophistication, and the HolesWarm operators are just the latest malware coders taking advantage of the large number of servers running out-of-date software. IOCs are available in the reports linked above, and in the Twitter thread below, from security firm Intezer Labs, which also saw some of the botnet's earlier attacks. [1/5] XMRig miner dropper, written in Golang, targets both Windows and Linux. The Linux dropper has no detections in VirusTotalhttps://t.co/CiZEG2vUXk Upon execution, the dropper creates persistence and queries the C&C for extra payload over windowsupdatev1.json
->> pic.twitter.com/wV0BhJA5tw
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/new-holeswarm-botnet-targets-windows-and-linux-servers