8220 Gang Exploiting Oracle WebLogic Flaw to Hijack Servers and Mine Cryptocurrency – The Hacker News
The notorious cryptojacking group tracked as 8220 Gang has been spotted weaponizing a six-year-old security flaw in Oracle WebLogic servers to ensnare vulnerable instances into a botnet and distribute cryptocurrency mining malware.
The flaw in question is CVE-2017-3506 (CVSS score: 7.4), which, when successfully exploited, could allow an unauthenticated attacker to execute arbitrary commands remotely.
"This allows attackers to gain unauthorized access to sensitive data or compromise the entire system," Trend Micro researcher Sunil Bharti said in a report published this week.
8220 Gang, first documented by Cisco Talos in late 2018, is so named for its original use of port 8220 for command-and-control (C2) network communications.
"8220 Gang identifies targets via scanning for misconfigured or vulnerable hosts on the public internet," SentinelOne noted last year. "8220 Gang is known to make use of SSH brute force attacks post-infection for the purposes of lateral movement inside a compromised network."
Earlier this year, Sydig detailed attacks mounted by the "low-skill" crimeware group between November 2022 and January 2023 that aim to breach vulnerable Oracle WebLogic and Apache web servers and deploy a cryptocurrency miner.
It has also been observed making use of an off-the-shelf malware downloader known as PureCrypter as well as a crypter codenamed ScrubCrypt to conceal the miner payload and evade detection by security software.
In the latest attack chain documented by Trend Micro, the Oracle WebLogic Server vulnerability is leveraged to deliver a PowerShell payload, which is then used to create another obfuscated PowerShell script in memory.
This newly created PowerShell script disables Windows Antimalware Scan Interface (AMSI) detection and launches a Windows binary that subsequently reaches out to a remote server to retrieve a "meticulously obfuscated" payload.
The intermediate DLL file, for its part, is configured to download a cryptocurrency miner from one of the three C2 servers 179.43.155[.]202, work.letmaker[.]top, and su-94.letmaker[.]top using TCP ports 9090, 9091, or 9092.
Trend Micro said recent attacks have also entailed the misuse of a legitimate Linux tool called lwp-download to save arbitrary files on the compromised host.
"lwp-download is a Linux utility present in a number of platforms by default, and 8220 Gang making this a part of any malware routine can affect a number of services even if it were reused more than once," Bharti said.
"Considering the threat actor's tendency to reuse tools for different campaigns and abuse legitimate tools as part of the arsenal, organizations' security teams might be challenged to find other detection and blocking solutions to fend off attacks that abuse this utility."
Original post:
- Landmark cryptocurrency legislation passes US House, to be signed into law by President Trump - International Consortium of Investigative Journalists... - July 20th, 2025 [July 20th, 2025]
- Reeves eyes 5bn windfall from sale of seized cryptocurrency - The Independent - July 20th, 2025 [July 20th, 2025]
- Better Cryptocurrency to Buy Right Now: Cardano vs. Solana - The Motley Fool - July 20th, 2025 [July 20th, 2025]
- This Unstoppable Cryptocurrency Is Now As Big As Amazon, and It Could Soar By Another 10,500%, According to Strategy's Michael Saylor - Yahoo Finance - July 20th, 2025 [July 20th, 2025]
- What are stablecoins and how do they affect the cryptocurrency market? - Yahoo Finance - July 20th, 2025 [July 20th, 2025]
- The Impact of Immediate Coin Access in Cryptocurrency - OneSafe - July 20th, 2025 [July 20th, 2025]
- Better Cryptocurrency to Buy Right Now: Cardano vs. Solana - MSN - July 20th, 2025 [July 20th, 2025]
- GENIUS Act: A Reality Check for Cryptocurrency Payments and Stablecoin Adoption - OneSafe - July 20th, 2025 [July 20th, 2025]
- Which Cryptocurrency Is More Likely to Be a Millionaire Maker? Bitcoin vs. Ethereum - The Motley Fool - July 20th, 2025 [July 20th, 2025]
- Ethereum Just Approached $3,500. 3 Reasons This Leading Cryptocurrency Is Still a Buy - The Motley Fool - July 20th, 2025 [July 20th, 2025]
- The U.S. Government and Its Cryptocurrency Holdings Shaping Market Reverberations - OneSafe - July 20th, 2025 [July 20th, 2025]
- House sends bill regulating stablecoins, a type of cryptocurrency, to Trump - AP News - July 20th, 2025 [July 20th, 2025]
- Crypto surges: Cryptocurrency mcap reaches record high at $4 trillion; What's driving the rally? - Times of India - July 20th, 2025 [July 20th, 2025]
- PBKMiner launches original XRP (Ripple) AI cloud mining application for Bitcoin miners, allowing everyone to easily earn cryptocurrency income -... - July 20th, 2025 [July 20th, 2025]
- House sends first-of-its-kind cryptocurrency legislation to Trumps desk after conservative revolt briefly delayed it - CNN - July 18th, 2025 [July 18th, 2025]
- What's a stablecoin? House passes landmark bills to regulate the cryptocurrency - USA Today - July 18th, 2025 [July 18th, 2025]
- House sends bill regulating stablecoins, a type of cryptocurrency, to Trump - CNBC - July 18th, 2025 [July 18th, 2025]
- Mike Lee wants to keep the government out of peoples cryptocurrency. Here's why - Deseret News - July 18th, 2025 [July 18th, 2025]
- Why the Healthcare Industry Is Exploring Cryptocurrency Development for Payments and Data Security - Vocal - July 18th, 2025 [July 18th, 2025]
- This Unstoppable Cryptocurrency Is Now As Big As Amazon, and It Could Soar By Another 10,500%, According to Strategy's Michael Saylor - The Motley... - July 18th, 2025 [July 18th, 2025]
- DEA, FBI seize $10 million in cryptocurrency 'directly linked to the Sinaloa cartel' - Fox News - July 18th, 2025 [July 18th, 2025]
- House votes on trio of cryptocurrency bills aimed at legitimizing the industry - MyNorthwest.com - July 18th, 2025 [July 18th, 2025]
- House Passes Three Key Cryptocurrency Bills, Including Stablecoin Regulation - AInvest - July 18th, 2025 [July 18th, 2025]
- Massive victory for Cryptocurrency as Stablecoins bill passed by US House of Representatives. What does th - The Economic Times - July 18th, 2025 [July 18th, 2025]
- House Approves GENIUS and CLARITY Laws for Cryptocurrency Regulation - AInvest - July 18th, 2025 [July 18th, 2025]
- The Crypto cabinet: One in five of Trumps closet allies hold significant cryptocurrency assets - The Independent - July 18th, 2025 [July 18th, 2025]
- Bitcoin rose above $120,000 after key cryptocurrency bills were passed in the US - - July 18th, 2025 [July 18th, 2025]
- House votes on trio of cryptocurrency bills aimed at legitimizing the industry - morning-times.com - July 18th, 2025 [July 18th, 2025]
- House sends GENIUS Act to Trump, sends other cryptocurrency bills to Senate - WWAYTV3 - July 18th, 2025 [July 18th, 2025]
- Trump Cryptocurrency Innovation Could Bring Homeownership to Millions - The Daily Signal - July 18th, 2025 [July 18th, 2025]
- In a win for Trump, US House passes three landmark cryptocurrency bills - Firstpost - July 18th, 2025 [July 18th, 2025]
- Why there's so much excitement around a cryptocurrency called stablecoin - NPR - July 16th, 2025 [July 16th, 2025]
- Cease-fire talks, cryptocurrency and other news from Washington - CBS News - July 16th, 2025 [July 16th, 2025]
- Welcome to "Crypto Week." With Two Cryptocurrency-Focused Bills in the House This Week, Is The Industry Officially Mainstream? - The Motley... - July 16th, 2025 [July 16th, 2025]
- Police investigate suspicious disappearance of California man linked to cryptocurrency fortune - New York Post - July 16th, 2025 [July 16th, 2025]
- New NC initiative trying to combat growing cryptocurrency ATM scams - CBS 17 - July 16th, 2025 [July 16th, 2025]
- Global Cryptocurrency Payment Apps Market Projected to Reach $2.4 Billion By 2033 as Demand Rises - GlobeNewswire - July 16th, 2025 [July 16th, 2025]
- 1 Top Cryptocurrency to Buy Before It Soars 3,260%, According to Cathie Wood of ARK Invest - Yahoo Finance - July 16th, 2025 [July 16th, 2025]
- Bitcoin News Today: Cryptocurrency Market Sees Mixed Performance Bitcoin Drops 1.32% Ethereum Surges 5.27% - AInvest - July 16th, 2025 [July 16th, 2025]
- Amaze Holdings, Inc. Unveils Cryptocurrency Initiative to Transform Global Payments and Monetization for Creators - Quiver Quantitative - July 16th, 2025 [July 16th, 2025]
- Mike Johnson remarks on cryptocurrency bill failure - WAAY 31 News - July 16th, 2025 [July 16th, 2025]
- What is Crypto Weekand how will it affect Bitcoin, XRP, and other cryptocurrency prices? - Fast Company - July 16th, 2025 [July 16th, 2025]
- 1 Top Cryptocurrency to Buy Before It Soars 1,850%, According to VanEck - The Motley Fool - July 16th, 2025 [July 16th, 2025]
- 3 Factors Behind Bitcoin's Latest Record High. Will This Major Cryptocurrency Continue to Rise? - The Motley Fool - July 16th, 2025 [July 16th, 2025]
- 1 Top Cryptocurrency to Buy Before It Soars 3,260%, According to Cathie Wood of ARK Invest - The Motley Fool - July 16th, 2025 [July 16th, 2025]
- Cryptocurrency could be part of future UK banking system - The Independent - July 16th, 2025 [July 16th, 2025]
- NR7 Miner launches an easy-to-use XRP cloud mining platform that uses artificial intelligence technology to help cryptocurrency enthusiasts easily... - July 16th, 2025 [July 16th, 2025]
- Donald Trump Jr.: Cryptocurrency will grow into a multi-trillion dollar industry - PANews - July 16th, 2025 [July 16th, 2025]
- Grayscale's IPO Bid and Crypto Week: A Turning Point for U.S. Cryptocurrency Regulation - OKX - July 16th, 2025 [July 16th, 2025]
- Hyper Bit Technologies Expands Cryptocurrency Holdings with New Agreement - TipRanks - July 16th, 2025 [July 16th, 2025]
- The cryptocurrency week craze swept the world, WinnerMining free cloud mining APP helps users easily earn BTC and XRP with zero investment on their... - July 16th, 2025 [July 16th, 2025]
- The Smartest Cryptocurrency to Buy With $1,000 Right Now - The Motley Fool - July 14th, 2025 [July 14th, 2025]
- Bitcoin tops $120,000 for the first time - Reuters - July 14th, 2025 [July 14th, 2025]
- Cryptocurrency Live News & Updates : Ethereum Overtakes Platinum in Asset Rankings - The Economic Times - July 14th, 2025 [July 14th, 2025]
- The Smartest Cryptocurrency to Buy With $1,000 Right Now - Yahoo Finance - July 14th, 2025 [July 14th, 2025]
- House Votes on Key Cryptocurrency Bills This Week - AInvest - July 14th, 2025 [July 14th, 2025]
- Navigating Cryptocurrency in Your 401(k): Opportunities and Risks - Investopedia - July 14th, 2025 [July 14th, 2025]
- 3 Ways to Invest in Cryptocurrency That Will Let You Sleep at Night - The Motley Fool - July 14th, 2025 [July 14th, 2025]
- What is BlockDAG and its Significance in Cryptocurrency? - OneSafe - July 14th, 2025 [July 14th, 2025]
- Why Public Companies Are Embracing Cryptocurrency: Insights and Implications - OneSafe - July 14th, 2025 [July 14th, 2025]
- Cryptocurrency Market Surges 100% Driven by Institutional Adoption and Stablecoin Growth - AInvest - July 14th, 2025 [July 14th, 2025]
- Should You Follow This 1 Shocking Cryptocurrency Recommendation From a Top Financial Advisor? - The Motley Fool - July 14th, 2025 [July 14th, 2025]
- Promising Cryptocurrency Stocks To Watch Today - July 13th - MarketBeat - July 14th, 2025 [July 14th, 2025]
- Cryptocurrency Firms Expand into US Banking Amid Favorable Regulations - AInvest - July 14th, 2025 [July 14th, 2025]
- Okalio Mining: Cryptocurrency market is booming, just turn on your phone and easily earn BTC, ETH, and XRP! - GlobeNewswire - July 14th, 2025 [July 14th, 2025]
- The Growing Perils of Unchecked Cryptocurrency in China - OneSafe - July 14th, 2025 [July 14th, 2025]
- Bitcoin, the cryptocurrency market leader, hit another record high on the 13th (local time) and is o.. - - July 14th, 2025 [July 14th, 2025]
- Sheriffs office warns of scams involving Bitcoin, cryptocurrency ATMs in TN - WVLT - July 14th, 2025 [July 14th, 2025]
- Crypto investors look ahead to policy wins, propelling bitcoin to record high - Reuters - July 12th, 2025 [July 12th, 2025]
- Fake Gaming and AI Firms Push Malware on Cryptocurrency Users via Telegram and Discord - The Hacker News - July 12th, 2025 [July 12th, 2025]
- Ripplecoin Mining Unveils Revolutionary Free Cloud Mining App, Set to Reshape Cryptocurrency Investment and Profit for All - TradingView - July 12th, 2025 [July 12th, 2025]
- Small Cap Movers: Bitcoin treasuries stocks surge as cryptocurrency hits another all-time high - MSN - July 12th, 2025 [July 12th, 2025]
- Ripplecoin Mining Unveils Revolutionary Free Cloud Mining App, Set to Reshape Cryptocurrency Investment and Profit for All - GlobeNewswire - July 12th, 2025 [July 12th, 2025]
- Sheriffs office warns of scams involving Bitcoin, cryptocurrency ATMs in TN - WSMV - July 12th, 2025 [July 12th, 2025]
- Bitcoin tops $118,000 for the first time, as the cryptocurrency continues to climb to new heights - Indiana Gazette Online - July 12th, 2025 [July 12th, 2025]
- This Formerly High-Flying Cryptocurrency Has the Potential to Become the New Bitcoin, According to Tom Lee of Fundstrat - The Motley Fool - July 12th, 2025 [July 12th, 2025]
- Now, Emirates Partners with Crypto to Introduce Cryptocurrency Payment Option, Heres All You Need To Know - Travel And Tour World - July 12th, 2025 [July 12th, 2025]
- Bitcoin Tops $118,000 For The First Time, As The Cryptocurrency Continues To Climb To New Heights - WBAP - July 12th, 2025 [July 12th, 2025]
- Trade Tensions and Cryptocurrency: Navigating USD Volatility in a Tariff-Driven Market - AInvest - July 12th, 2025 [July 12th, 2025]
- Bitcoin tops $118K as crypto rally gains momentum (BTC-USD:Cryptocurrency) - Seeking Alpha - July 12th, 2025 [July 12th, 2025]