Forest Global Training Partners

Cyber Risks · Cisco Talos

Widespread JBoss Backdoors a Major Threat

Summary: Cisco Talos scanned the internet for vulnerable JBoss servers and found approximately 3.2 million at-risk machines, then found just over 2,100 backdoors installed across nearly 1,600 IP addresses, with affected parties including schools, governments, and aviation companies. Talos identified multiple webshells including "mela", "shellinvoker", "jbossinvoker", "zecmd", "cmd", "genesis", and "sh3ll", which it says implies many systems were compromised several times by different actors.

What you should know: More than 2,100 backdoors across roughly 1,600 IP addresses means a large population of servers an attacker can already control remotely and use to pivot laterally inside internal networks - and the multiple distinct webshells on single hosts show that patching once does not clear out whoever came before.

Read the original at Cisco Talos ↗

Topics
Malware
Related