Exposed JDWP Interface Exploited to Deploy XMRig Miner and Establish Persistence
Summary
Wiz researchers observed attackers exploit exposed JDWP on a TeamCity honeypot to run commands, deploy a customized XMRig miner, and establish persistence. Their tests detected JDWP exploitation attempts within hours.
Key points
- The attackers reached a Wiz TeamCity honeypot with JDWP exposed on port 5005; Wiz observed exploitation attempts within hours of exposing test machines.
- The attackers used JDWP protocol commands to locate Java Runtime methods and execute shell commands, likely using a modified jdwp-shellifier variant.
- A dropper downloaded a customized XMRig miner disguised as the logrotate utility; the hardcoded configuration avoided suspicious command-line arguments.
- The dropper installed persistence through shell startup files, boot scripts, systemd, and cron jobs, and could re-fetch and relaunch itself.
- The miner used pool proxies to obscure the cryptocurrency wallet address, according to the researchers.
- Wiz found more than 6,000 unique IP addresses scanning for JDWP endpoints in GreyNoise data from the previous 90 days.
- The article lists indicators including payload servers at awarmcorner[.]world and canonicalconnect[.]com, and a miner pool at 185.208.156[.]247:3333.
Article Details
- Attack Vectors
- The attacker scanned the internet for exposed JDWP ports, then used a JDWP handshake and protocol requests to inspect JVM classes and methods and invoke java.lang.Runtime.exec() to run commands.
- Commands downloaded and launched a dropper script, which fetched a modified XMRig miner from remote payload servers.
- The dropper established persistence through systemd, cron jobs, shell startup files, and distribution-specific boot scripts.
- Defensive Notes
- Do not expose JDWP interfaces to the internet; restrict debugger access and secure debug configurations.
- Monitor for unexpected JDWP connections and Java Runtime command execution, as well as changes to cron entries, systemd services, shell startup files, and boot scripts.
- Investigate suspicious files named logrotate, especially in ~/.config, and look for unauthorized XMRig processes or unusually high CPU usage.
- Wiz reports that its agentless malware detection and Runtime Sensor can detect related malware and behaviors.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 176[.]65[.]148[.]239 | IP address identified as a JDWP scanner. |
| IPV4 | 176[.]65[.]148[.]57 | IP address identified as a JDWP scanner. |
| IPV4 | 176[.]65[.]148[.]86 | IP address identified as a JDWP scanner. |
| IPV4 | 185[.]196[.]8[.]123 | Payload server serving the logservice.sh script, also listed as a file server. |
| IPV4 | 185[.]196[.]8[.]41 | IP address identified as a mining pool. |
| IPV4 | 185[.]196[.]8[.]86 | File server identified as hosting payloads. |
| SHA1 | 0851a95d46f035c7759782299422bcfd794e2aec | SHA-1 hash identified in the article for the malicious logrotate-named payload. |
| SHA1 | 1879d5fa0c2ca816fcb261e96338e325e76dca09 | SHA-1 hash identified in the article for the logservice.sh dropper. |
| SHA1 | 18d83ba336ca6926ce8b9d68f104cff053f0c2f9 | SHA-1 hash identified in the article for o.sh, an attack script. |
| SHA1 | 2d4a23e861ef41df6953195fa4cda115e37a7218 | SHA-1 hash identified in the article for the malicious logrotate-named payload. |
| SHA1 | 7074d674d120d19aa7e44e29dd126af152ccdb7c | SHA-1 hash identified in the article for the malicious logrotate-named payload. |
| SHA1 | 815bc1a79440cdc4a7e1d876ff2dc7bc4f53d25e | SHA-1 hash identified in the article for the malicious logrotate-named payload. |
| SHA1 | a923de9df0766d6c4be46191117b8cc6486cf19c | SHA-1 hash identified in the article for the logservice.sh dropper. |
| SHA1 | baf0a3b92225f56499c6879b176a3d6163b9d3ef | SHA-1 hash identified in the article for the malicious logrotate-named payload. |
| SHA1 | ea7c97294f415dc8713ac8c280b3123da62f6e56 | SHA-1 hash identified in the article for XMRig 6.22 used as a mining payload. |
| URL | hxxps[:]//aheatcorner[.]world | Domain identified as a previous payload file server. |
| URL | hxxps[:]//awarmcorner[.]world/silicon64blueprints.png | Payload URL used to download the miner for x86_64 systems. |
| URL | hxxps[:]//awarmcorner[.]world/siliconarmblueprints.png | Payload URL used to download the miner for aarch64 systems. |
| URL | hxxps[:]//awarmcorner[.]world/siliconarmv7blueprints.png | Payload URL used to download the miner for armv7l systems. |
| URL | hxxps[:]//canonicalconnect[.]com/logservice.sh | Dropper download URL used in the observed JDWP exploitation commands. |
| URL | hxxps[:]//cozy[.]yachts | Domain identified as a previous payload file server. |
| URL | hxxps[:]//s3[.]tebi[.]io/dhcpdc/o.sh | Payload URL identified in the article's IOC list. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe attacker named the modified XMRig payload and its systemd service logrotate to resemble the legitimate utility.T1037.004 · RC ScriptsThe dropper added persistence commands to rc.local or /etc/rc.d/rc.local.T1053.003 · CronThe dropper added recurring persistence commands to cron locations and schedules.T1059.004 · Unix ShellThe dropper runs commands through bash and uses shell scripts to download and execute payloads.T1105 · Ingress Tool TransferThe attacker used curl and wget to retrieve the dropper and miner from remote servers.T1210 · Exploitation of Remote ServicesThe attacker exploited an exposed JDWP service to gain remote code execution in the running Java process.T1496 · Resource HijackingThe modified XMRig payload mined cryptocurrency on compromised systems.T1543.002 · Systemd ServiceThe dropper created and enabled a systemd service that launches the malicious logrotate-named binary and restarts it.T1546.004 · Unix Shell Configuration ModificationThe dropper appended commands to bash and zsh startup files to re-fetch and execute the payload.