Hadooken and K4Spreader: The 8220 Gang's Latest Arsenal
ID: 792f7817-42d6-540c-97ab-a062d211ea50
STIX ID: report--792f7817-42d6-540c-97ab-a062d211ea50
Feed Name: Sekoia.com
Threat Score
On 17 September 2024 Sekoia’s TDR observed active exploitation of Oracle WebLogic RCEs (CVE-2017-10271 and CVE-2020-14883) against a honeypot, resulting in multi-stage infections that deployed K4Spreader/Hadooken, the Tsunami IRC backdoor and a PwnRig/XMRig cryptominer; analysis of TTPs, shared payloads, domains, IPs and an identical Monero wallet ties the campaign to the 8220 Gang and describes cross-platform persistence, lateral movement and ongoing mining activity affecting hundreds of cloud-hosted systems.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.