Rocke: The Champion of Monero Miners

blog.talosintelligence.com · 30 Aug 2018 · Licence: not assessed; coordinator-only cache; do not redistribute

CVEs this report names

2 CVEs

CVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Oracle · WebLogic ServerKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing Application T1499.004Application or System Exploitation2 reports
>99.9%Top 0.01%
84.4priority
CVE-2017-3066Adobe ColdFusion Deserialization Vulnerability
Adobe · ColdFusionKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
90.6%Top 0.2%
73.7priority

Where it names them

CVE-2017-10271

we first observed this actor exploiting vulnerabilities in Apache Struts, we've also observed what we believe to the same individual exploiting an Oracle WebLogic server vulnerability (CVE-2017-10271), and also exploiting CVE-2017-3066, a critical Java deserialization vulnerability in the Adobe ColdFusion

Original ↗

CVE-2017-3066

we first observed this actor exploiting vulnerabilities in Apache Struts, we've also observed what we believe to the same individual exploiting an Oracle WebLogic server vulnerability (CVE-2017-10271), and also exploiting CVE-2017-3066, a critical Java deserialization vulnerability in the Adobe ColdFusion

Original ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.