By exploiting a known vulnerability on Internet-facing Oracle WebLogic servers, threat actors deployed cryptocurrency miners to Linux and Windows systems.

Unpatched Oracle WebLogic Servers Infected with Cryptocurrency Software

Adding multifactor authentication for services such as Exchange Online (Office 365) can prevent threat actors from stealing credentials.

Minimize Business Email Compromise Risk by Protecting Credentials

Read how efforts to keep ransomware profitable have led threat actors to move beyond a technical focus and adopt psychological tactics.

Ransomware Tactics and Mind Games

Organizations should consider endpoint solutions as part of a comprehensive security program, and maximum effectiveness requires implementation prior to an incident occurring.

Effective Incident Response Requires Visibility

Incident Response Team

script-src 'self' 'nonce-#nonce#' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-lVilk2e8qE1rxMg9jxL8K48EwZUpx7Xrf/mm/A5yXWM=' 'sha256-DIygzAg/0fLKA/hDn0YGU7s62O7L/lceyCzUXjE3Pps=' https://code.jquery.com https://pages.secureworks.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://content.secureworks.jp https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://script.crazyegg.com https://hammock.hotprofile.biz https://*.hotprofile.biz https://*.hot-profile.com https://*.on24.com https://*.ceros.com https://*.redditstatic.com https://*.ensighten.com https://*.ml314.com https://*.choozle.com https://*.bluekai.com https://cdn.bizible.com https://cdn.bizibly.com https://ws-assets.zoominfo.com https://ws.zoominfo.com https://insight.adsrvr.org https://js.adsrvr.org https://*.clarity.ms https://static.ads-twitter.com https://cdn.pdst.fm https://*.cloudfunctions.net https://tag.demandbase.com https://*.bidr.io https://*.company-target.com https://www.teads.com https://p.teads.tv https://www.facebook.com connect.facebook.net; img-src 'self' https://*.teads.tv https://*.jsdelivr.net *.hot-profile.com reviews.static.gartner.com dam.secureworks.com *.vidyard.com cdn.jsdelivr.net googleads.g.doubleclick.net content.secureworks.com *.secureworks.jp id.rlcdn.com *.googletagmanager.com cdn.cookielaw.org *.gstatic.com optanon.blob.core.windows.net web.secureworks.com bat.bing.com *.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com *.adslinkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.redditstatic.com alb.reddit.com *.ensighten.com ml314.com *.choozle.com *.bluekai.com cdn.bizible.com cdn.bizibly.com tracking.monsido.com *.clarity.ms analytics.twitter.com t.co *.bidr.io *.company-target.com www.facebook.com t.teads.tv https://ssl.gstatic.com *.secureworks.com *.secureworks.jp https://www.gstatic.com blob: data:; frame-ancestors 'self' *.folloze.com https://calculator.value-cloud.com *.secureworks.com *.secureworks.jp; worker-src 'self' blob: data:;

RELATED BLOGS

Unpatched Oracle WebLogic Servers Infected with Cryptocurrency Software