Sodinokibi ransomware exploits Web Logic Server vulnerability
Summary: Attackers exploited CVE-2019-2725, a WebLogic Server vulnerability Oracle patched on April 26 outside its normal cycle, to install a new ransomware variant called Sodinokibi that encrypts user directories and deletes shadow copy backups. The attackers used PowerShell and certutil commands to download radm.exe from IP addresses 188.166.74[.]218 and 45.55.211[.]79, and about eight hours after deploying Sodinokibi they returned with a second CVE-2019-2725 exploit to distribute Gandcrab v5.2.
Why it matters: This attack used a zero-day, so it could work on otherwise fully-patched systems, and with a CVSS score of 9.8 and WebLogic's ubiquity, Talos expects widespread attacks involving CVE-2019-2725.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-2725
- Related
- Attackers Increasingly Targeting Oracle Web Logic Server Vulnerability for XMRig and Ransomware Cyber Risks ·CVE-2019-2725: Oracle Web Logic Server, Injection Known Exploited Vulnerabilities · Jan 10, 2022Threat Source newsletter (May 9) Cyber Risks ·