Hadooken Malware is Targeting Oracle WebLogic Servers with DDoS Attacks

Hackers are targeting Oracle WebLogic servers with a new Linux malware called "Hadooken." This malware is a powerful tool used for a range of malicious activities, including cryptomining, distributed denial-of-service (DDoS) attacks, and potentially even ransomware.

The threat actors behind Hadooken exploit vulnerabilities in WebLogic servers, often leveraging weak credentials to gain access. Once they've gained a foothold, they download and execute shell and Python scripts that ultimately install Hadooken.

This malware works by dropping and executing a cryptominer alongside Tsunami, a Linux DDoS botnet malware known for brute-forcing vulnerable SSH servers. Hadooken cleverly masks its malicious activities by renaming its services to mimic legitimate processes like "-bash" or "-java," making it harder to detect. It also wipes system logs to cover its tracks, further hindering discovery and forensic analysis.

What's particularly concerning is Hadooken's potential connection to ransomware. While no ransomware modules were deployed in the observed attacks, static analysis of the Hadooken binary revealed links to the RHOMBUS and NoEscape ransomware families. The researchers speculate that ransomware deployment might be a future strategy, potentially after manual checks or as part of a later release.

The threat actors' tactics are not limited to Linux systems. The researchers discovered a PowerShell script on a server delivering Hadooken that downloaded the Mallox ransomware for Windows. This suggests a coordinated attack targeting both Linux servers and Windows endpoints, potentially leveraging the same compromised WebLogic servers to deploy ransomware.

The ubiquity of WebLogic servers makes this threat particularly dangerous. Shodan search engine data reveals over 230,000 WebLogic servers exposed on the public internet, offering a vast pool of potential targets for the Hadooken attackers.

The use of cryptomining and DDoS attacks, along with the potential for ransomware deployment, makes Hadooken a multifaceted threat. It highlights the importance of robust security measures to protect WebLogic servers, including strong authentication, regular patching, and advanced threat detection capabilities.

Organizations should be aware of the risks posed by Hadooken and take proactive steps to secure their WebLogic servers. This includes:

• Patching vulnerabilities: Regularly update WebLogic servers with the latest security patches to address known vulnerabilities exploited by Hadooken.

• Implementing strong authentication: Employ multi-factor authentication (MFA) and robust password policies to prevent unauthorized access.

• Monitoring network traffic: Use security information and event management (SIEM) tools to monitor network traffic for suspicious activity, including unusual patterns or attempts to access sensitive systems.

• Deploying intrusion detection and prevention systems (IDS/IPS): Implement IDS/IPS solutions to detect and block malicious traffic targeting WebLogic servers.

• Running regular security scans: Conduct periodic vulnerability assessments to identify potential weaknesses in your security posture.

• Keeping backups: Regularly back up critical data to ensure recovery in case of a ransomware attack.

• Educating employees: Train employees about best practices for cybersecurity hygiene, including recognizing phishing attempts and avoiding risky websites.

Staying vigilant and implementing these security measures is crucial to protect your organization from the growing threat posed by Hadooken and similar attacks targeting WebLogic servers.