Spring4Shell Exploited to Drop Web Shells and Cryptocurrency Miners
Vulnerability Disclosure · 6 sources · Updated 2mo ago · First seen Mar 31, 2022
Attackers began exploiting the Spring Framework remote code execution flaw Spring4Shell (CVE-2022-22965) to plant JSP web shells on vulnerable Apache Tomcat servers and deliver cryptocurrency miners. Trend Micro reported attempts that wrote a web shell named zbc0fb.jsp into the Tomcat web root, then used it to run operating-system-specific payloads on both Windows and Linux systems. The activity followed Spring's disclosure of the RCE issue and its guidance to upgrade to fixed releases, including Spring Framework 5.3.18 and 5.2.20 or later.
On Windows targets, the observed chain used hidden PowerShell execution to fetch ldr.ps1 in memory, which then downloaded a miner from 194.145.227.21. The miner was designed to disable the firewall, kill competing miner processes and services bound to common mining ports, launch the payload, and establish persistence through a scheduled task named BrowserUpdate and a Windows Run key. The intrusion pattern mirrors earlier enterprise-server exploitation seen in incidents such as WebLogic RCE leading to XMRig, underscoring how rapidly newly disclosed Java server flaws are weaponized for opportunistic cryptomining.
