Malwarehigh
Muhstik botnet adds Oracle WebLogic and Drupal exploits
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-10271 | Unauthenticated Remote Code Execution in Oracle WebLogic Server | 7.5 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2018-7600 | Unauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2019-2725 | Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE | 9.8 | 100% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ffly.su | u kei.su “The two other domains linked to the analytics ID (ffly.su and kei.su) were also configured as C2s for various other L |
| domain | fflyy.su | s search exposed the following 3 domains using the same ID: fflyy.su kei.su “The two other domains linked to the analytics ID (f |
| domain | irc.de-zahlung.eu | nfrastructure exposed some interesting correlations. IRC C2 irc.de-zahlung.eu shared an SSL cert with site jaygame.net, which is an amate |
| domain | jaygame.net | ions. IRC C2 irc.de-zahlung.eu shared an SSL cert with site jaygame.net, which is an amateur site about a game involving an Anime c |
| domain | kei.su | exposed the following 3 domains using the same ID: fflyy.su kei.su “The two other domains linked to the analytics ID (ffly.su |
| ipv4 | 159.89.156.190 | the architecture. Below some download URL examples: hxxp://159.89.156.190/.y/pty2 hxxp://167.99.39.134/.x/pty3 “Upon successful insta |
| ipv4 | 167.99.39.134 | download URL examples: hxxp://159.89.156.190/.y/pty2 hxxp://167.99.39.134/.x/pty3 “Upon successful installation Mushtik will contact |
| url | http://159.89.156.190/.y/pty2 | to map the architecture. Below some download URL examples: hxxp://159.89.156.190/.y/pty2 hxxp://167.99.39.134/.x/pty3 “Upon successful installation |
| url | http://167.99.39.134/.x/pty3 | w some download URL examples: hxxp://159.89.156.190/.y/pty2 hxxp://167.99.39.134/.x/pty3 “Upon successful installation Mushtik will contact the IRC |
From the original article
2 min read at securityaffairs.com
Muhstik botnet leverages known web application exploits to compromise IoT devices, now it targeting Oracle WebLogic, Drupal. Muhstik is a botnet that is known to use web application exploits to compromise IoT devices, it has been around for at least 2018. Botnet operators monetize their efforts via XMRig, combined with DDoS-for-hire services.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.