InfoSecBulletin Cybersecurity for mankind
Researchers said, threat actor exploiting vulnerabilities in Oracle WebLogic Server, notably CVE-2017-3506 and CVE-2023-21839 to deploy cryptocurrency miners via PowerShell scripts.
Trend Micro researchers published a new analysis by Ahmed Mohamed Ibrahim, Shubham Singh, and Sunil Bharti. “The threat actor employs fileless execution techniques, using DLL reflective and process injection, allowing the malware code to run solely in memory and avoid disk-based detection mechanisms,”
Cisco released security updates for two critical security flaws
OpenBAS: Cutting-edge breach and attack simulation platform
Critical Security Flaws Patched in Zyxel Networking Devices
CVE-2024-38811: CEV In VMware Fusion Unveiled
CERT-IN Warns Vulnerabilities in Palo Alto Networks applications
How Malaysia’s Data Centre Industry Poised for Growth
RansomHub exfiltrated data over 210 victims: US alert
Godzilla Fileless Backdoor Exploits Atlassian Confluence flaw
New Cicada ransomware targets VMware ESXi servers
Monday hits two UK bank apps causes outages
The cybersecurity firm is tracking the financially motivated actor under the name Water Sigbin who exploits vulnerabilities in Oracle WebLogic Server for initial access and payload delivery.
After gaining access, a PowerShell script is used to drop a fake “wireguard2-3.exe” file that looks like the real WireGuard VPN app. In reality, it runs a different “cvtres.exe” file in memory using a DLL (“Zxpus.dll”).
The hacker news reported, the injected executable serves as a conduit to load the PureCrypter loader (“Tixrgtluffu.dll”) that, in turn, exfiltrates hardware information to a remote server and creates scheduled tasks to run the miner as well as excludes the malicious files from Microsoft Defender Antivirus.
The C2 server sends an encrypted message with the XMRig configuration details. Then, the loader pretends to be a legitimate Microsoft binary called “AddinProcess.exe” and downloads and runs the miner from a domain controlled by the attacker.
The 8220 Gang has been using a new installer tool called k4spreader since at least February 2024. Malicious software in development uses security vulnerabilities in Apache Hadoop YARN, JBoss, and Oracle WebLogic Server to attack vulnerable targets.
“k4spreader is written in cgo, including system persistence, downloading and updating itself, and releasing other malware for execution,” the company said, adding it’s also designed to disable the firewall, terminate rival botnets (e.g., kinsing), and printing operational status.
