The honeypot detected 15 exploitation attempts within 24 hours, targeting CVE-2020-14883 and CVE-2017-10271, all originating from a single IP address linked to Aeza Group Ltd.
A critical remote code execution vulnerability was discovered in Oracle WebLogic Server due to a flaw in the WLS-WSAT component. An attacker can exploit this vulnerability by sending a crafted XML request to bypass authentication and execute arbitrary code, potentially compromising the affected system.
The attacker used the lwp-download binary to download a shell script named “2.gif” from a remote server, which was saved in the /tmp directory and executed to initiate the next stage of the attack, demonstrating a unique tactic not commonly seen with wget or curl.
Oracle WebLogic Server’s administration console is vulnerable to unauthenticated RCE (CVE-2020-14883). Attackers exploit this by sending malicious HTTP requests and executing arbitrary commands on Linux (m.xml) or Windows (m1.xml) servers.
They executed a cross-platform attack strategy, targeting both Linux and Windows systems using malicious XML files. The Linux attacks involved downloading and executing C and Python files, while the Windows attacks utilized PowerShell scripts.
The Windows script first disables antivirus detection using a third-party PowerShell script. It then decrypts and executes a base64-encoded string, eventually running a C# binary that downloads and loads a cryptocurrency miner.
Loader CCleaner, a .NET-based program, downloads a file from a specified URL, decrypts it using 3DES to obtain a .NET DLL, loads a class from the DLL, and downloads and executes an encrypted payload from another URL, ultimately launching a cryptominer.
The “c” script disables cloud protection, downloads and executes Hadooken, and attempts lateral movement via SSH brute force after analyzing network configuration files, while the “y” script downloads and runs Hadooken.
K4Spreader, a Go-based malware, is a multi-stage threat that disables cloud security, terminates competing cryptomining processes, and deploys additional malware like Tsunami and PwnRig.
Tsunami, a Linux-based DDoS bot, uses IRC C2 servers for command and control by leveraging old UnrealIRCd software and specific IRC channels. The “sck-dns[.]cc” domain is used both for persistence and C2, linked to AS 210644.
The PwnRig cryptominer, a variant of XMRig, mines Monero through private proxy mining pools accessible via “run.on-demand.pw,” which establishes persistence on infected systems using cron jobs, /etc/init.d/ services, and systemd services.
The Hadooken and K4Spreader campaigns are likely linked to the same intrusion set due to similar targeting, infection chains, and payloads. A comparative analysis suggests they are distinct Go-based malware variants with potential connections.
An analysis by Sekoia Blog of compromised machines on the Tsunami IRC channel indicates that the 8220 Gang is primarily targeting vulnerable cloud servers, particularly those running WebLogic, Drupal, or Apache Struts.
The majority of victims are located in Asia, with a significant concentration in South America, potentially due to the involvement of a South American operator.