InfoSecBulletin Cybersecurity for mankind
Researchers said, threat actor exploiting vulnerabilities in Oracle WebLogic Server, notably CVE-2017-3506 and CVE-2023-21839 to deploy cryptocurrency miners via PowerShell scripts.
Trend Micro researchers published a new analysis by Ahmed Mohamed Ibrahim, Shubham Singh, and Sunil Bharti. “The threat actor employs fileless execution techniques, using DLL reflective and process injection, allowing the malware code to run solely in memory and avoid disk-based detection mechanisms,”
WhatsApp banned on all US House of Representatives devices
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
The cybersecurity firm is tracking the financially motivated actor under the name Water Sigbin who exploits vulnerabilities in Oracle WebLogic Server for initial access and payload delivery.
After gaining access, a PowerShell script is used to drop a fake “wireguard2-3.exe” file that looks like the real WireGuard VPN app. In reality, it runs a different “cvtres.exe” file in memory using a DLL (“Zxpus.dll”).
The hacker news reported, the injected executable serves as a conduit to load the PureCrypter loader (“Tixrgtluffu.dll”) that, in turn, exfiltrates hardware information to a remote server and creates scheduled tasks to run the miner as well as excludes the malicious files from Microsoft Defender Antivirus.
The C2 server sends an encrypted message with the XMRig configuration details. Then, the loader pretends to be a legitimate Microsoft binary called “AddinProcess.exe” and downloads and runs the miner from a domain controlled by the attacker.
The 8220 Gang has been using a new installer tool called k4spreader since at least February 2024. Malicious software in development uses security vulnerabilities in Apache Hadoop YARN, JBoss, and Oracle WebLogic Server to attack vulnerable targets.
“k4spreader is written in cgo, including system persistence, downloading and updating itself, and releasing other malware for execution,” the company said, adding it’s also designed to disable the firewall, terminate rival botnets (e.g., kinsing), and printing operational status.
