Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity
High
Analysis Summary
A recently disclosed vulnerability in Oracle WebLogic server that we reported earlier today is being actively exploited to install a new variant of ransomware called “Sodinokibi.” This ransomware attempts to encrypt data in a user’s directory and deletes shadow copy backups to make data recovery more difficult.
The vendor has released a patch for this vulnerability. It’s an easily exploitable flaw as anyone with HTTP access to the WebLogic server could carry out an attack. When the ransomware successfully infected a machine, it left the following ransom note, attached as a sample:
Indicators of Compromise are given below. The Attacker’s IP address was reported by Cisco’s Talos Blog as follows:
This IP has previously been reported multiple times, as seen on https://www.abuseipdb.com/check/130.61.54.136.
Impact
Files Encryption
Indicators of Compromise
IP(s) / Hostname(s)
130.61.54[.]136
URLs
Malware Hash (MD5/SHA1/SH256)
Affected Vendors
Oracle
Affected Products
Oracle WebLogic Server
Remediation