Lucene search

Sunil BhartiTRENDMICROBLOG:7F5BE5F8A4681AFA25BE43543440A0AF

HistoryMay 30, 2024 - 12:00 a.m.

Decoding Water Sigbin's Latest Obfuscation Tricks

2024-05-3000:00:00

Sunil Bharti

www.trendmicro.com

water sigbin

8220 gang

oracle weblogic

cve-2017-3506

cve-2023-21839

cryptocurrency miner

powershell script

threat actor

new techniques

conceal activities

attacks defense

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

Low

0.955 High

EPSS

Percentile

99.4%

JSON

Water Sigbin (aka the 8220 Gang) exploited the Oracle WebLogic vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner using a PowerShell script. The threat actor also adopted new techniques to conceal its activities, making attacks harder to defend against.