Aqua caught the malware in a honeypot WebLogic server. The attack exploited a weak password to gain entry, then remotely executed malicious code. The first payload runs a shell script called "c" and a Python script called "y" – both of which attempted to download Hadooken.

The Hadooken backdoor affecting the popular Java app server carries a cryptomining program and links to ransomware.

After achieving initial server access via weak passwords, threat actors proceeded to launch a pair of scripts to retrieve the Hadooken malware, which features not only a cryptocurrency miner but also the Tsunami distributed denial-of-service botnet.

New Linux malware 'Hadooken' targets Oracle Weblogic, deploys crypto miners and DDoS botnet. Exploits vulnerabilities for lateral movement.

Criminals have been spotted abusing poorly-defended Oracle WebLogic servers to mine cryptocurrency, build a DDoS botnet, and more. Cybersecurity researchers Aqua saw several attacks in the wild, and decided to run a honeypot.

Hackers are targeting Oracle WebLogic servers to infect them with a new Linux malware named "Hadooken," which launches a cryptominer and a tool for distributed denial-of-service (DDoS) attacks.