InfoSecBulletin Cybersecurity for mankind
Researchers said, threat actor exploiting vulnerabilities in Oracle WebLogic Server, notably CVE-2017-3506 and CVE-2023-21839 to deploy cryptocurrency miners via PowerShell scripts.
Trend Micro researchers published a new analysis by Ahmed Mohamed Ibrahim, Shubham Singh, and Sunil Bharti. “The threat actor employs fileless execution techniques, using DLL reflective and process injection, allowing the malware code to run solely in memory and avoid disk-based detection mechanisms,”
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
Critical Cisco ISE Vulnerability Enables Remote Code Execution
F5 Patches NGINX Flaw for Code Execution and DoS Attacks
FortiBleed: 70,000 Fortinet Firewalls Compromised Globally
New Rokarolla Android malware hits 217 banking and crypto apps
Phishing Campaign Exploits Legitimate Microsoft Login Flow
ALERT
Cisco SD-WAN Zero-Day, FortiSandbox and cPanel flaws exploited in attacks
“Panthalassa” builds floating AI data centers powered by ocean waves
Critical Wazuh Vuln Enables Alert Tampering and Evidence Deletion
The cybersecurity firm is tracking the financially motivated actor under the name Water Sigbin who exploits vulnerabilities in Oracle WebLogic Server for initial access and payload delivery.
After gaining access, a PowerShell script is used to drop a fake “wireguard2-3.exe” file that looks like the real WireGuard VPN app. In reality, it runs a different “cvtres.exe” file in memory using a DLL (“Zxpus.dll”).
The hacker news reported, the injected executable serves as a conduit to load the PureCrypter loader (“Tixrgtluffu.dll”) that, in turn, exfiltrates hardware information to a remote server and creates scheduled tasks to run the miner as well as excludes the malicious files from Microsoft Defender Antivirus.
The C2 server sends an encrypted message with the XMRig configuration details. Then, the loader pretends to be a legitimate Microsoft binary called “AddinProcess.exe” and downloads and runs the miner from a domain controlled by the attacker.
The 8220 Gang has been using a new installer tool called k4spreader since at least February 2024. Malicious software in development uses security vulnerabilities in Apache Hadoop YARN, JBoss, and Oracle WebLogic Server to attack vulnerable targets.
“k4spreader is written in cgo, including system persistence, downloading and updating itself, and releasing other malware for execution,” the company said, adding it’s also designed to disable the firewall, terminate rival botnets (e.g., kinsing), and printing operational status.
