InfoSecBulletin Cybersecurity for mankind
Researchers said, threat actor exploiting vulnerabilities in Oracle WebLogic Server, notably CVE-2017-3506 and CVE-2023-21839 to deploy cryptocurrency miners via PowerShell scripts.
Trend Micro researchers published a new analysis by Ahmed Mohamed Ibrahim, Shubham Singh, and Sunil Bharti. “The threat actor employs fileless execution techniques, using DLL reflective and process injection, allowing the malware code to run solely in memory and avoid disk-based detection mechanisms,”
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
The cybersecurity firm is tracking the financially motivated actor under the name Water Sigbin who exploits vulnerabilities in Oracle WebLogic Server for initial access and payload delivery.
After gaining access, a PowerShell script is used to drop a fake “wireguard2-3.exe” file that looks like the real WireGuard VPN app. In reality, it runs a different “cvtres.exe” file in memory using a DLL (“Zxpus.dll”).
The hacker news reported, the injected executable serves as a conduit to load the PureCrypter loader (“Tixrgtluffu.dll”) that, in turn, exfiltrates hardware information to a remote server and creates scheduled tasks to run the miner as well as excludes the malicious files from Microsoft Defender Antivirus.
The C2 server sends an encrypted message with the XMRig configuration details. Then, the loader pretends to be a legitimate Microsoft binary called “AddinProcess.exe” and downloads and runs the miner from a domain controlled by the attacker.
The 8220 Gang has been using a new installer tool called k4spreader since at least February 2024. Malicious software in development uses security vulnerabilities in Apache Hadoop YARN, JBoss, and Oracle WebLogic Server to attack vulnerable targets.
“k4spreader is written in cgo, including system persistence, downloading and updating itself, and releasing other malware for execution,” the company said, adding it’s also designed to disable the firewall, terminate rival botnets (e.g., kinsing), and printing operational status.
