DarkIRC botnet is targeting the critical Oracle WebLogic CVE-2020
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-14882 | Remote Code Execution in Oracle WebLogic Server | 9.8 | 100% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cnc.c25e6559668942.xyz | hell script to download and execute a binary file hosted in cnc[.]c25e6559668942[.]xyz DarkIRC authors used a crypter to avoid detection, it i |
From the original article
2 min read at securityaffairs.com
The critical remote code execution (RCE) vulnerability CVE-2020-14882 in Oracle WebLogic is actively exploited by operators behind the DarkIRC botnet. Experts reported that the DarkIRC botnet is actively targeting thousands of exposed Oracle WebLogic servers in the attempt of exploiting the CVE-2020-14882 .
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.