Hadooken Malware: A New Threat to WebLogic Servers

Aqua Nautilus researchers report a new Linux malware family called Hadooken that targets Oracle WebLogic servers by exploiting known vulnerabilities or brute-forcing admin credentials; it uses multi-stage Python and shell scripts to install a cryptominer and the Tsunami backdoor, harvest SSH credentials for lateral movement, and clears logs to evade detection. The report urges patching WebLogic, enforcing strong passwords/MFA, monitoring network activity, and maintaining backups.