Analysis of JDWPMiner Mining Trojan: Remote Debugging with Java Causes Hidden Risks

guest · Aug 13, 2021

Analysis of JDWPMiner Mining Trojan: Remote Debugging with Java Causes Hidden Risks
August 12, 2021
https://www.alibabacloud.com/blog/a...ebugging-with-java-causes-hidden-risks_598002

Recently, the Alibaba Cloud Security Team detected a malicious mining attack by exploiting the RCE vulnerability of JDWP. JDWP is widely used in the development and debugging of Java applications, while Java is widely used in the development of e-commerce, office applications, CMS, and other platforms that are closely related to daily life. If remote debugging is not closed during the software release, major hidden risks will be left behind. JDWPMiner uses this feature for profitable intrusion.

Alibaba Cloud security experts have found that the botnet exploits the Java Debug RCE by downloading mining binary files from malicious download source files to achieve mining. Then, it persists through Crontab, writes the secret key to authorized_keys to get remote access, and runs four methods to rebound the shell to take full control of the host. Thus, user assets will achieve great harm.

Alibaba Cloud Security continuously monitors the BOT, finding that its spread has increased recently. Users are advised to pay attention to BOT defense.
Click to expand...

Log in or Sign up

Analysis of JDWPMiner Mining Trojan: Remote Debugging with Java Causes Hidden Risks

guest Guest

Log in or Sign up

Analysis of JDWPMiner Mining Trojan: Remote Debugging with Java Causes Hidden Risks

guest Guest

Useful Searches