Loading story…
Attackers exploited Oracle WebLogic Server vulnerability CVE-2019-2725 to deploy the Sodinokibi ransomware, using the exposed AsyncResponderService endpoint to run commands on vulnerable servers. Cisco Talos reported in-the-wild activity beginning at least in mid-April, with exploitation intensifying after Oracle released an out-of-band patch for the flaw, which carried a CVSS 9.8 rating and could be abused by anyone with HTTP access to an unpatched WebLogic instance.
The intrusion chain used HTTP POST requests to launch cmd.exe and PowerShell, with some cases using certutil to fetch payloads such as radm.exe from attacker-controlled infrastructure. Once executed, Sodinokibi encrypted victim files and attempted to delete Windows shadow copies to obstruct recovery, while ransom instructions pointed victims to Tor-based payment resources and the clear-web domain decryptor[.]top. Talos also observed follow-on attempts to exploit the same WebLogic flaw to deliver GandCrab v5.2, indicating operators were opportunistically monetizing access to exposed enterprise servers.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Roughly eight hours after deploying Sodinokibi, the attackers attempted another CVE-2019-2725 exploitation to distribute GandCrab v5.2. Talos assessed this as evidence of opportunistic monetization or uncertainty about whether the first ransomware deployment had succeeded.
Attackers sent HTTP POST requests to the AsyncResponderService endpoint on a vulnerable Oracle WebLogic server, executing cmd.exe and PowerShell or certutil to download and run payloads including radm.exe. The intrusion resulted in successful encryption on a number of systems and deletion attempts against Windows shadow copies.
Oracle released an out-of-band patch for the Oracle WebLogic Server vulnerability CVE-2019-2725. The flaw was described as easy to exploit by anyone with HTTP access to a vulnerable server.
Initial stages of the ransomware attack occurred as a trial to determine whether targeted Oracle WebLogic servers were exploitable. Talos described this as pre-deployment activity preceding the ransomware installation.
Cisco Incident Response and Cisco Talos observed attackers exploiting Oracle WebLogic vulnerability CVE-2019-2725 in the wild since at least this date. The activity later led to ransomware delivery against vulnerable servers.
The clear-web domain decryptor[.]top, later used to direct victims for payment and decryption instructions, was registered. Talos identified it as part of the Sodinokibi ransomware workflow.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Sodinokibi**, also known as **REvil** and **BlueCrab**, was distributed through multiple intrusion paths while its operators and affiliates steadily refined payload delivery and defense evasion. Researchers documented infections delivered via malspam, spear-phishing, compromised websites, exposed or stolen **RDP** access, and exploitation of vulnerabilities including `CVE-2019-2725`, `CVE-2018-13379`, and `CVE-2019-11510`. In South Korea, attackers also abused vulnerable WordPress sites for **SEO poisoning**, planting fake forum pages that pushed victims to download ZIP archives containing malicious JavaScript, which then fetched additional scripts, launched PowerShell, loaded a .NET injector in memory, and executed the ransomware through a Delphi-based loader. The operation paired technical sophistication with aggressive monetization. Analysts reported frequent changes to JavaScript obfuscation, command-and-control paths, PowerShell execution methods, process injection techniques, and target process names to reduce antivirus detection, alongside logic to disable security tooling and delete **Volume Shadow Copies** before encryption. IBM described the group’s use of **Curve25519**, **ECDH**, **Salsa20**, **AES**, and **SHA-3** in its encryption workflow, as well as its **double-extortion** model of stealing data and threatening publication on **The Happy Blog**. The ransomware was linked to a broad affiliate ecosystem, represented **22%** of IBM X-Force incident response engagements in 2020, and was reported to heavily impact organizations in the United States, United Kingdom, Australia, and Canada.
Aug 14, 2026
Attackers actively exploited **Oracle WebLogic Server** flaw `CVE-2020-14882` to achieve unauthenticated remote code execution, with intrusions quickly progressing from opportunistic scanning to malware deployment. Incident reporting showed one campaign using obfuscated PowerShell to fetch a **Cobalt Strike** payload from `185[.]205.210.179`, while another used a malicious `wbw.xml` file and follow-on scripts to install **XMRig**, rename it to `sysupdate`, and establish persistence with a scheduled task, driving victim CPU usage to 100%. Researchers warned the same access pattern could be readily adopted by ransomware operators because Cobalt Strike is commonly used in hands-on-keyboard attacks. Technical analysis tied the exploitation to improper access control and path traversal in WebLogic console resources, where double URL decoding and abuse of `console.portal` and the `handle` parameter enabled code execution through **MVEL** and reflection. Oracle’s initial fix was found to be incomplete because blacklist-based URL filtering could be bypassed with trivial changes, leading to the related patch-bypass issue `CVE-2020-14750`. Defenders were urged to apply Oracle’s latest patches and hunt for indicators linked to `console.portal`, malicious PowerShell downloaders, miner artifacts, and published **YARA**, **Sigma**, and **Suricata** detections.
Aug 15, 2026
Attackers have been targeting **Oracle WebLogic** servers with a newly identified Linux malware dubbed **Hadooken**, using compromised access to install a cryptominer and the **Tsunami** DDoS botnet. Researchers observed the activity on a honeypot and found the initial intrusion relied on **weak credentials** rather than exploitation of a software flaw, after which the operators used shell and Python-based tooling to deploy malware, gain persistence through cron jobs, and erase logs to reduce visibility. Post-compromise activity showed the attackers searching for SSH data, attempting lateral movement, and expanding control across Linux environments. Analysis also linked Hadooken infrastructure and code overlaps to **RHOMBUS** and **NoEscape** ransomware families, while a PowerShell payload hosted on a related delivery server was seen downloading **Mallox** ransomware for Windows, indicating the campaign may combine immediate monetization through cryptomining and DDoS with follow-on ransomware operations against mixed Linux and Windows estates.
Aug 14, 2026