Tag: 8220 Gang

By taking advantage of known security holes in the Oracle WebLogic Server, security researchers have added more insight into the cryptocurrency mining operation carried out by the 8220 Gang. "The threat actor uses DLL reflective and process injection, fileless execution techniques, allowing the malware code to run solely in memory and avoid disk-based detection mechanisms," Ahmed Mohamed Ibrahim, Shubham Singh, and Sunil Bharti, researchers at Trend Micro, stated in a new analysis released today. The financially driven actor is being tracked by the cybersecurity firm under the handle Water Sigbin. This actor is known to weaponize Oracle WebLogic Server vulnerabilities like CVE-2017-3506, CVE-2017-10271, and CVE-2023-21839 for initial access and to drop the miner payload using a mult...