'Hadooken' Linux malware targets Oracle WebLogic servers

Aqua researchers observed attackers exploiting weak passwords on Oracle WebLogic servers to deploy a new Linux malware named “Hadooken.” The malware contains a cryptominer and the Tsunami DDoS/backdoor, creates cronjobs for persistence, can steal credentials for lateral movement, and was traced to two IP addresses; analysts also noted possible ties to RHOMBUS and NoEscape ransomware families.