Muhstik Botnet Exploits the Latest Web Logic Vulnerability for Cryptomining and DDoS Attacks
Summary: On April 28, 2019, Unit 42 discovered a new variant of the Linux botnet Muhstik exploiting the WebLogic vulnerability CVE-2019-2725, disclosed five days earlier, to install itself on vulnerable systems. The botnet, active since March 2018 with worm-like self-propagation, infects Linux servers and IoT devices to run cryptocurrency mining and DDoS attacks, and the captured exploit payload contained a single shell command to download wl.php from IP address 165.227.78[.]159.
What's compelling: Muhstik added the exploit within five days of disclosure, and Oracle's emergency patch released April 26, 2019 was confirmed to block this variant - the gap between disclosure and weaponization is measured in days, not weeks.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-10271CVE-2019-2725
- Related
- Attackers Increasingly Targeting Oracle Web Logic Server Vulnerability for XMRig and Ransomware Cyber Risks ·CVE-2017-10271: Oracle Corporation Web Logic Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022CVE-2019-2725: Oracle Web Logic Server, Injection Known Exploited Vulnerabilities · Jan 10, 2022