Monero Miner  - jB0pQ1515648362 - Oracle Weblogic Exploit used to Deploy Monero Miner

server is vulnerable to cryptocurrency mining.The security researcher has found this to mine coins in the compromised machine.

This critical bug allows to run arbitrary commands with WebLogic server with user privileges.

The vulnerability (CVE 2017-10271) was present in the WebLogic Web Services component (wls-wsat) and due to lack of improperly user input sanitizing which allow an unauthenticated remote attacker to install and run crypto miners and hijacking their processing power to mine Monero coins makes the spike in CPU usage.

The attackers begun using Chinese security researcher Lian Zhang published a proof-of-concept exploit in December, says Johannes Ullrich, dean of research for SANS Technology Institute.

Also Read: CoffeeMiner – Hacking into WiFi Networks to Inject Cryptocurrency Miners

Ullrich explains Crypto mining relies on lots of processing power generated by computers, servers, and even mobile devices, to mine cryptocurrency.

The attackers use Dropper script which checks for the Web Services while accessing the URL <HOST>/wls-wsat/CoordinatorPortType, then dropped script download the and executes it.intentionally kills the Weblogic service on the target.check figure

- weblogic Imagem1 - Oracle Weblogic Exploit used to Deploy Monero Miner

The script downloads the miner and executes it and intentionally kills the Weblogic service on the target.

- weblogic Imagem2 - Oracle Weblogic Exploit used to Deploy Monero Miner

The attackers using this exploit  to launch crypto miners on PeopleSoft, WebLogic app servers and Amazon cloud environments that were tied to WebLogic app servers, Ullrich says

According to Ullrich, the miner software being used in the is xmrig, which is a legitimate crypto coin miner for Monero.

According to SANS threat list cryptocurrencies, miners in your network can be found out by correlating the network traffic which contains IP addresses.

Ullrich said finally “It is very likely that more sophisticated attackers used this to gain a persistent foothold on the system. In this case, the only ‘persistence’ we noticed was the CRON job. But there are many more – and more difficult to detect – ways to gain persistence.”

The indicators for this specific campaign includes:

IOCs (Indicators of Compromise)



Hashes (MD5) Monero Miner


Source link
Based Blockchain Network


Please enter your comment!
Please enter your name here