Cybercriminals Leverage Java Debug Wire Protocol Servers to Launch Cryptomining Attacks

The Wiz Security Team has recently conducted research that shows a significant increase in attacks that target well-known CI/CD platforms like TeamCity and take use of weak Java Debug Wire Protocol (JDWP) interfaces.

These attacks, detected via honeypot deployments, reveal a significant uptick in both speed and sophistication.

Within just a few hours of exposing a JDWP-enabled TeamCity server to the internet, malicious actors successfully achieved remote code execution (RCE), deployed cryptomining malware, and implemented diverse persistence mechanisms to maintain long-term control.

JDWP is a Java platform feature meant for debugging live applications, offering developers valuable introspection capabilities.

It is commonly enabled using JVM flags, such as -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005.

Critically, JDWP provides no authentication or access control by default. When Internet-exposed, this lack of security transforms JDWP into a high-risk entrypoint, granting attackers the ability to execute arbitrary code with the privileges of the running Java process.

While JDWP is not active by default in most Java applications, many tools TeamCity, Jenkins, Selenium Grid, Elasticsearch, Quarkus, Spring Boot, and Apache Tomcat among them activate JDWP in debug mode, often without warning developers of the associated risks.

Customized XMRig Payload

Attackers initiated their campaign by scanning for open JDWP ports, such as the default 5005.

Upon establishing a JDWP session, they conducted protocol-level negotiations using a JDWP-Handshake, checked loaded JVM classes, and identified exploitable methods, particularly java.lang.Runtime.getRuntime().exec().

The exploitation chain involved creating strings containing download and execution commands such as fetching malicious scripts via curl or wget executed directly through JDWP-invoked Java methods.

The primary dropper script observed, dubbed logservice.sh, demonstrated advanced evasion and persistence.

It would terminate competing miners or high-CPU processes, download a custom XMRig miner disguised as the legitimate “logrotate” binary, and install itself across various startup points: user shell profiles, rc.local, systemd units, and multiple cron schedules.

The malicious XMRig variant featured a hardcoded configuration, circumventing suspicious command-line arguments, and communicated via mining pool proxies to obscure wallet addresses. This deliberate obfuscation hinders detection and forensic efforts by defenders.

Persistence mechanisms were comprehensive. Modifications were made to rc.local and cron job configurations on both Debian and RedHat-based systems, fake systemd services were created, and shell profile scripts were amended to guarantee execution upon user login or system reboot.

The attack script also ensured its own deletion post-execution, leaving only the disguised binary behind.

Widespread Targeting

Analysis showed highly automated exploitation, with over 6,000 unique IP addresses observed scanning for JDWP endpoints in just 90 days, underscoring JDWP’s attractiveness as a target for cybercriminals.

Multiple threat actors appeared to leverage similar tactics, seeking rapid deployment of cryptominers before defenders could respond.

According to the Report, The attackers’ use of tailored miners and stealthy installation methods makes traditional detection and response particularly challenging. Security vendors like Wiz offer a layered defense strategy against such attacks.

Their agentless malware detection and runtime sensors monitor for behavioral indicators from JDWP exploitation and suspicious network activity to unauthorized changes in system services and cryptomining workload patterns alerting defenders to each stage of the kill chain.

The campaign is a potent reminder that exposing development and debugging services like JDWP to the internet even inadvertently creates a critical security liability.

Organizations must review their deployment practices, ensure administrative ports are firewalled or access controlled, and employ advanced monitoring to catch stealthy post-exploitation activity.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates