PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

wiz.io | blog | #rce | #teamcity | #misconfiguration | #honeypot | #cryptomining | #wiz-research | #jdwp
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Research documents an intrusion via an exposed JDWP debug port: attackers went from a TeamCity honeypot to RCE in hours, planting a modified XMRig miner with persistence and mining-pool proxies.
Published
Collected

Related coverage

blog · wiz.io
I know what you mined last summer: summarizing Summer '23 cryptomining activity
Wiz Research summarizes Summer 2023 cryptomining: seven campaigns using XMRig, CCminer and XMR-Stak-RX, entering via open Jupyter Notebooks and unpatched Apache Solr 8.1.1, with IOCs.
blog · wiz.io
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz Research analyzes NordStellar logs to map credentials harvested by infostealers like Lumma and RedLine, showing how stolen keys and tokens unlock AWS, Azure, GitHub, and AI platforms.
blog · wiz.io
Snipping the Long Tail of Shai-Hulud 2.0
Wiz Research on Shai-Hulud 2.0's long tail: infections ran 100-200 repos/day, 90%+ via a zombie OpenVSX extension; a clean release cut it to a handful, while leaked secrets remain unrotated.
blog · wiz.io
Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces
Wiz Research uncovered 550+ valid secrets across 500+ VSCode and Open VSX extensions — over a hundred enabled malicious updates — and worked with Microsoft on marketplace guardrails.
blog · wiz.io
Introducing HoneyBee: How We Automate Honeypot Deployment for Threat Research
Wiz introduces HoneyBee, an open-source tool that auto-generates intentionally misconfigured Docker deployments, with Nuclei validation templates, so researchers can deploy realistic honeypots safely.
blog · wiz.io
IMDS Abused: Hunting Rare Behaviors to Uncover Exploits
Wiz shares how hunting anomalous IMDS usage — the metadata service attackers abuse for credentials — uncovered a zero-day being exploited in the wild in a popular web service.
Back