Loading story…
Attackers have been targeting Oracle WebLogic servers with a newly identified Linux malware dubbed Hadooken, using compromised access to install a cryptominer and the Tsunami DDoS botnet. Researchers observed the activity on a honeypot and found the initial intrusion relied on weak credentials rather than exploitation of a software flaw, after which the operators used shell and Python-based tooling to deploy malware, gain persistence through cron jobs, and erase logs to reduce visibility.
Post-compromise activity showed the attackers searching for SSH data, attempting lateral movement, and expanding control across Linux environments. Analysis also linked Hadooken infrastructure and code overlaps to RHOMBUS and NoEscape ransomware families, while a PowerShell payload hosted on a related delivery server was seen downloading Mallox ransomware for Windows, indicating the campaign may combine immediate monetization through cryptomining and DDoS with follow-on ransomware operations against mixed Linux and Windows estates.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Static analysis linked the Hadooken binary to the RHOMBUS and NoEscape ransomware families, and researchers also found a PowerShell script on a Hadooken delivery server that downloaded Mallox ransomware for Windows. Aqua Security assessed this may indicate a dual-use operation targeting Linux systems for cryptomining and backdoor access, with possible later ransomware deployment against Windows endpoints.
Aqua Security observed attackers compromising an Oracle WebLogic honeypot via weak credentials and deploying a newly identified Linux malware named Hadooken. The malware installed a cryptominer and the Tsunami DDoS botnet, while using scripts for SSH harvesting, lateral movement, persistence, and log wiping.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
Attackers actively exploited **Oracle WebLogic Server** flaw `CVE-2020-14882` to achieve unauthenticated remote code execution, with intrusions quickly progressing from opportunistic scanning to malware deployment. Incident reporting showed one campaign using obfuscated PowerShell to fetch a **Cobalt Strike** payload from `185[.]205.210.179`, while another used a malicious `wbw.xml` file and follow-on scripts to install **XMRig**, rename it to `sysupdate`, and establish persistence with a scheduled task, driving victim CPU usage to 100%. Researchers warned the same access pattern could be readily adopted by ransomware operators because Cobalt Strike is commonly used in hands-on-keyboard attacks. Technical analysis tied the exploitation to improper access control and path traversal in WebLogic console resources, where double URL decoding and abuse of `console.portal` and the `handle` parameter enabled code execution through **MVEL** and reflection. Oracle’s initial fix was found to be incomplete because blacklist-based URL filtering could be bypassed with trivial changes, leading to the related patch-bypass issue `CVE-2020-14750`. Defenders were urged to apply Oracle’s latest patches and hunt for indicators linked to `console.portal`, malicious PowerShell downloaders, miner artifacts, and published **YARA**, **Sigma**, and **Suricata** detections.
Aug 15, 2026
Darktrace reported a new **Chaos** malware variant compromising misconfigured Linux cloud servers after observing an intrusion through its CloudyPots honeypot network. In the incident, attackers abused an exposed Apache Hadoop application-creation or resource-manager endpoint to achieve remote command execution, then downloaded a 64-bit Linux ELF payload from `pan.tenire[.]com`, changed its permissions, executed it, and removed it from disk. The activity marks an expansion for the Go-based malware family, which had previously been associated mainly with routers, edge devices, DDoS operations, cryptomining, SSH brute-forcing, and exploitation of known vulnerabilities. The updated sample retained persistence and multi-protocol **DDoS** functionality while adding a **SOCKS5 proxy** capability that could relay attacker traffic and support internal network pivoting. Darktrace said some older spreading and exploitation features appear to have been removed, suggesting a shift toward proxy-enabled botnet operations rather than broader self-propagation. The malware used `gmserver.osfc[.]org[.]cn` to resolve command-and-control infrastructure and communicated over port `65111`; researchers also noted Chinese-language strings, `zh-CN` locale indicators, and infrastructure overlap with a ValleyRAT campaign, although they said any attribution to a Chinese threat actor remains circumstantial.
Jun 29, 2026