reader comments
25 with 15 posters participating
Malicious hackers have been hammering servers with attacks that exploit the recently discovered SpringShell vulnerability in an attempt to install cryptomining malware, researchers said.
SpringShell came to light late last month when a researcher demonstrated how it could be used to remotely execute malicious code on servers that run the Spring model-view-controller or WebFlux applications on top of Java Development Kit versions 9 or higher. Spring is the most widely used Java framework for developing enterprise-level applications in Java. The framework is part of a sprawling ecosystem that provides tools for things like cloud, data, and security apps.
Earlier this month, security firm Trend Micro said it began detecting attempts. From April 1 to April 12, company researchers detected an average of roughly 700 attempts per day to exploit the vulnerability to install cryptomining software. By running the malware on powerful enterprise servers, criminals can mine Bitcoin or other types of digital cash using the resources and electricity of an unwitting victim.
The number of exploit attempts peaked on April 3 at almost 3,000.
The hackers first sent commands that were designed to discern if the vulnerable servers were running Windows or Linux. Then they ran exploit code that tried to install a type of interface known as a web shell, which allows a remote user to run commands using a Web-based window.
install the Mirai botnet. Anyone running the Spring model-view-controller or WebFlux applications on the JDK version 9 or higher should patch the flaw as soon as practical.
