Cyber Risks · Unit 42 Palo Alto Networks

Attackers Increasingly Targeting Oracle Web Logic Server Vulnerability for XMRig and Ransomware

Summary: Unit 42 researchers at Palo Alto Networks documented exploitation of an Oracle WebLogic Server deserialization vulnerability (CVE-2019-2725) before Oracle released an out-of-band patch on April 26, 2019, with the first monitored incidents on April 25, 2019. Attackers used the flaw to deliver a new Muhstik botnet version, the Sodinokibi and GandCrab ransomware variants, and XMRig cryptominers, with over 600 exploitation attempts recorded on Palo Alto Networks soak sites and more than 41,000 publicly accessible WebLogic instances reported by Zoomeye.org.
Key Takeaway: The vulnerability carries a CVSS v3.0 score of 9.8, requires no user interaction, and sits in a package included by default in widely used WebLogic versions 10.3.6 and 12.1.3, so any unpatched instance is reachable by a remote, unauthenticated attacker.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2017-10271 CVE-2019-2725
Related: Muhstik Botnet Exploits the Latest Web Logic Vulnerability for Cryptomining and DDoS Attacks Cyber Risks ·
Sodinokibi ransomware exploits Web Logic Server vulnerability Cyber Risks ·
Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices Cyber Risks ·