The attacker known as the “8220 Gang” is associated with a new payload targeting Oracle Weblogic Server that can be exploited at a specific URI (Uniform Resource Identifier).
The payload analyzed by Fortinet security researchers is characterized by an extract of ScrubCrypt, a type of malware designed to obfuscate and encrypt applications in order to avoid detection by security programs. .
“We analyzed the malware injected into the victim’s system and, as part of our analysis, used the collected metrics to identify the attacker as the 8220 gang,” says Cara, senior antivirus analyst at Fortinet. Lin wrote in Wednesday’s advisory. “This mining her group first appeared in her 2017. The name ‘8220’ comes from her first use of port 8220 for network communication. “
According to Lin, ScrubCrypt has been updated at least once. Its authors have ensured that malware can bypass Windows Defender and provide anti-debugging and some bypass capabilities.
“We collected several ScrubCrypt samples in February, each with a slightly different payload,” wrote a malware analyst, adding that the attacks Fortinet observed occurred between January and February 2023. I am adding.
Additionally, security experts have linked both the crypto wallet addresses used in these attacks and the server IP addresses used in the Monero miner to the 8220 gang in the past, allowing for links to the threat group. (despite the port number used). for attacks that are no longer 8220).
“The 8220 Gang is a well-known minor group that typically uses public file-sharing websites to target system vulnerabilities and infiltrate the victim’s environment,” added Lin.
“In a very short period of time, it has evolved to use newer Cryptor variants. [that] It contains evasion and encryption features that make it difficult for antivirus programs to detect 8220 gang activity. Users should be aware of this updated crypter and have their systems patched. “
The threat actor’s activity was also observed by Microsoft last year, and in July 2022 Microsoft issued an alert against the 8220 Gang.
Editorial image credit: max.ku / Shutterstock.com
