New Linux malware Hadooken targets Oracle WebLogic servers

Aqua Security observed a campaign abusing weak credentials on Oracle WebLogic servers to deploy a Linux malware family dubbed "Hadooken," which installs a cryptominer and the Tsunami DDoS bot, persists via randomized cron jobs and process renaming, searches for SSH keys to lateralize, and wipes logs; researchers also found links to ransomware (Mallox and references to RHOMBUS/NoEscape) on infrastructure used by the operator.