New Pro-Ocean crypto-miner targets Apache ActiveMQ, Oracle WebLogic, and Redis installs
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-3088 | Unauthenticated Arbitrary File Upload Leading to RCE in Apache ActiveMQ Fileserver CVE-2016-3088 is an improper input-validation flaw (CWE-434) in the Fileserver web application bundled with Apache ActiveMQ 5.x, which lets anyone upload files to the broker without authenticating. An attacker triggers it by sending an HTTP PUT request that uploads an attacker-controlled file (typically a crafted JSP) and then an HTTP MOVE request that relocates that file into a directory served by the embedded web console, where the Jetty web container executes it. This yields unauthenticated remote code execution with the privileges of the ActiveMQ process (CVSS 3.1: 9.8 critical, network-vector, no privileges or user interaction required). Any deployment of ActiveMQ 5.x prior to 5.14.0 is affected, and internet-exposed brokers are the most directly at risk. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10), has a public PoC on Exploit-DB, a 98.5% EPSS score, and has been used by real-world malware such as the XBash ransomware/miner and the Pro-Ocean crypto-mining campaign. Do: Upgrade to Apache ActiveMQ 5.14.0 or later, ideally a current supported release per vendor instructions. If upgrading is not immediately possible, disable or remove the Fileserver web application or restrict network access to the embedded Jetty web console (default TCP 8161) so it is not internet-exposed. Check web-access logs for suspicious HTTP PUT/MOVE requests against /fileserver/ and for unexpected JSP or script files in the web console directories, which would indicate prior compromise. | 9.8 | 99% | KEV PoC |
| largetens of thousands of internet-exposed ActiveMQ brokers (public scans index on the order of 10,000-100,000 exposed instances) | |
| CVE-2017-10271 | Unauthenticated Remote Code Execution in Oracle WebLogic Server Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue. Do: Apply Oracle's updates for CVE-2017-10271 per Oracle's instructions (the vendor's required action for this KEV entry). Until patched, restrict network access to WebLogic HTTP/admin ports from untrusted networks and limit or remove access to the XML/WSAT endpoints used for exploitation. Because ransomware operators are known to exploit this flaw, review internet-exposed WebLogic instances for signs of compromise, such as unexpected processes, new scheduled tasks, webshells, or ransomware artifacts. | 7.5 | 100% | KEV ransomware PoC ×3 |
| large≈tens of thousands of internet-exposed WebLogic Server instances (total deployed install base likely higher, including internal-only servers) |
Full article641 words · extracted from securityaffairs.com · click to collapse
The Rocke group is using a new piece of cryptojacking malware dubbed Pro-Ocean to target Apache ActiveMQ, Oracle WebLogic, and Redis installs.
The cybercrime group Rocke is using a new piece of cryptojacking malware called Pro-Ocean to target vulnerable Apache ActiveMQ, Oracle WebLogic, and Redis intalls.
The malware is an evolution of a Monero cryptocurrency miner that was first spotted by Unit 42 researchers in 2019.
The new malware implement new and improved rootkit and worm capabilities, it continues to target cloud applications by exploiting known vulnerabilities such as Oracle WebLogic (CVE-2017-10271) and Apache ActiveMQ (CVE-2016-3088) servers.
“Pro-Ocean uses known vulnerabilities to target cloud applications . In our analysis, we found Pro-Ocean targeting Apache ActiveMQ (CVE-2016-3088), Oracle WebLogic (CVE-2017-10271) and Redis (unsecure instances).” reads the analysis published by Palo Alto Networks. “In the case that the malware runs in Tencent Cloud or Alibaba Cloud, it will use the exact code of the previous malware to uninstall monitoring agents to avoid detection.”
Before installation, Pro-Ocean also attempts to remove other malware such as Luoxk, BillGates, XMRig and Hashfish. Once installed, the malicious code attempts to kill any process that heavily uses the CPU.
The installation script is written in Bash and is obfuscated, it is used to conduct multiple tasks that prepare the system for the deployment of the Pro-Ocean miner. The analysis of the code revealed that it was specifically designed to target cloud applications, among its targets there are Alibaba Cloud and Tencent Cloud.
Below the list of tasks carried out by the scripts:
- Attempt to remove other malware and miners (e.g. Luoxk, BillGates, XMRig, and Hashfish).
- Erase all of the cron tasks that could have been set up by other malware.
- Disable the iptables firewall so that the malware will have full access to the internet.
- In the case that the malware runs in Tencent Cloud or Alibaba Cloud, it will use the exact code of the previous malware to uninstall monitoring agents to avoid detection.
- Look for SSH keys and attempt to use them in order to infect new machines.
To avoid detection, the cryptocurrency Monero miner uses the native Linux feature LD_PRELOAD.
“LD_PRELOAD forces binaries to load specific libraries before others, allowing the preloaded libraries to override any function from any library. One of the ways to use LD_PRELOAD is to add the crafted library to /etc/ld.so.preload.” continues the analysis.
Pro-Ocean deploys an XMRig miner 5.11.1 to mine Monero, unlike 2019 variant, it uses a Python infection script to implement “wormable” capabilities.
This script retrieves the IP public address of an infected machine by querying the online service “ident.me,” then attempts to infect all the machines in the same 16-bit subnet (e.g. 10.0.X.X). The malicious code tries to execute public exploits against each machine in the subnet.
Upon successfully exploiting the above vulnerabilities, the Python script delivers a payload that downloads another script that fetches the Pro-Ocean from a remote HTTP server.
Palo Alto Networks researchers believe threat actors could expand the list of vulnerabilities to exploit to target the larger number of cloud applications as possible.
Rocke Group has been active at least since 2018 by Cisco Talos, their cryptomining operations have evolved over time with new feature and evasion techniques.
“Cryptojacking malware targeting the cloud is evolving as attackers understand the potential of that environment to mine for crypto coins. We previously saw simpler attacks by the Rocke Group, but it seems this group presents an ongoing, growing threat. This cloud-targeted malware is not something ordinary since it has worm and rootkit capabilities.” concludes the report. “We can assume that the growing trend of sophisticated attacks on the cloud will continue.”
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Pro-Ocean)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/114005/malware/pro-ocean-miner.html