Decoding Water Sigbin's Latest Obfuscation Tricks

Water Sigbin (aka the 8220 Gang) exploited the Oracle WebLogic vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner using a PowerShell script. The threat actor also adopted new techniques to conceal its activities, making attacks harder to defend against.

8220 gang actor attacks conceal cryptocurrency cryptocurrency miner cve cve-2023-21839 decoding deploy exploited gang latest making miner obfuscation oracle oracle weblogic powershell powershell script reports script techniques threat threat actor trend micro research : articles trend micro research : cloud trend micro research : endpoints trend micro research : reports trend micro research : research tricks vulnerabilities water weblogic