Security News > 2023 > March > New ScrubCrypt Crypter Used in Cryptojacking Attacks Targeting Oracle WebLogic
The infamous cryptocurrency miner group called 8220 Gang has been observed using a new crypter called ScrubCrypt to carry out cryptojacking operations.
According to Fortinet FortiGuard Labs, the attack chain commences with successful exploitation of susceptible Oracle WebLogic servers to download a PowerShell script that contains ScrubCrypt.
"ScrubCrypt is a crypter used to secure applications with a unique BAT packing method," security researcher Cara Lin said in a technical report.
The crypter, in the final stage, decodes and loads the miner payload in memory, thereby launching the miner process.
The development also comes as Sydig detailed attacks mounted by the 8220 Gang between November 2022 and January 2023 that aim to breach vulnerable Oracle WebLogic and Apache web servers to drop the XMRig miner.
In late January 2023, Fortinet also uncovered cryptojacking attacks that make use of Microsoft Excel documents containing malicious VBA macros that are configured to download an executable to mine Monero on infected systems.
News URL
https://thehackernews.com/2023/03/new-scrubcrypt-crypter-used-in.html
Related news
- 'Hadooken' Linux malware targets Oracle WebLogic servers (source)
- New Linux Malware Campaign Exploits Oracle Weblogic to Mine Cryptocurrency (source)
- New Linux malware Hadooken targets Oracle WebLogic servers (source)
- New Cryptojacking Attack Targets Docker API to Create Malicious Swarm Botnet (source)