Oracle WebLogic Exploit Used in Cryptocurrency Mining Campaign

Enterprises that failed to install Oracle’s critical WebLogic patch last October could find their PeopleSoft and cloud-based servers churning out cryptocurrency, a new discovery shows.

A security researcher found attackers had mined 611 Monero coins, which carries a current value of $226,070, by exploiting the WebLogic Flaw in vulnerable servers around the globe. Reports began to emerge earlier this week that a malicious campaign was underway to deploy Monero cryptocurrency miners on these unpatched systems, according to a blog post by Renato Marinho, chief research officer at Morphus Labs, who made the discovery.

The attackers were using a proof-of-concept exploit released in late December by Chinese researcher Lian Zhang that uses a critical vulnerability in the WebLogic app server; Oracle issued a patch for the flaw in October, says Johannes Ullrich, dean of research for SANS Technology Institute.

Read more about the cryptocurrency mining campaign using a proof-of-concept Oracle WebLogic exploit on DarkReading.

Track the strategic threats to your business with the Threat Brief, delivered to your email daily.

Subscribe Here