EHA
Home Hacks 8220 Hacker Group Adds Powerful New Tools: Hadooken & K4Spreader

8220 Hacker Group Adds Powerful New Tools: Hadooken & K4Spreader

0

The honeypot detected 15 exploitation attempts within 24 hours, targeting CVE-2020-14883 and CVE-2017-10271, all originating from a single IP address linked to Aeza Group Ltd.

A critical remote code execution vulnerability was discovered in Oracle WebLogic Server due to a flaw in the WLS-WSAT component. An attacker can exploit this vulnerability by sending a crafted XML request to bypass authentication and execute arbitrary code, potentially compromising the affected system.

The attacker used the lwp-download binary to download a shell script named “2.gif” from a remote server, which was saved in the /tmp directory and executed to initiate the next stage of the attack, demonstrating a unique tactic not commonly seen with wget or curl.

pcap of the CVE-2017-10271 exploitation

Oracle WebLogic Server’s administration console is vulnerable to unauthenticated RCE (CVE-2020-14883). Attackers exploit this by sending malicious HTTP requests and executing arbitrary commands on Linux (m.xml) or Windows (m1.xml) servers.

They executed a cross-platform attack strategy, targeting both Linux and Windows systems using malicious XML files. The Linux attacks involved downloading and executing C and Python files, while the Windows attacks utilized PowerShell scripts. 

The Windows script first disables antivirus detection using a third-party PowerShell script. It then decrypts and executes a base64-encoded string, eventually running a C# binary that downloads and loads a cryptocurrency miner. 

Windows infection routine

Loader CCleaner, a .NET-based program, downloads a file from a specified URL, decrypts it using 3DES to obtain a .NET DLL, loads a class from the DLL, and downloads and executes an encrypted payload from another URL, ultimately launching a cryptominer.

The “c” script disables cloud protection, downloads and executes Hadooken, and attempts lateral movement via SSH brute force after analyzing network configuration files, while the “y” script downloads and runs Hadooken. 

Linux infection routine

K4Spreader, a Go-based malware, is a multi-stage threat that disables cloud security, terminates competing cryptomining processes, and deploys additional malware like Tsunami and PwnRig.

Tsunami, a Linux-based DDoS bot, uses IRC C2 servers for command and control by leveraging old UnrealIRCd software and specific IRC channels. The “sck-dns[.]cc” domain is used both for persistence and C2, linked to AS 210644. 

The PwnRig cryptominer, a variant of XMRig, mines Monero through private proxy mining pools accessible via “run.on-demand.pw,” which establishes persistence on infected systems using cron jobs, /etc/init.d/ services, and systemd services.

pcap of mining activity – Linux case

The Hadooken and K4Spreader campaigns are likely linked to the same intrusion set due to similar targeting, infection chains, and payloads. A comparative analysis suggests they are distinct Go-based malware variants with potential connections.

An analysis by Sekoia Blog of compromised machines on the Tsunami IRC channel indicates that the 8220 Gang is primarily targeting vulnerable cloud servers, particularly those running WebLogic, Drupal, or Apache Struts. 

The majority of victims are located in Asia, with a significant concentration in South America, potentially due to the involvement of a South American operator.

Also Read:

NO COMMENTS

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Exit mobile version