The attack chain begins with brute-force attempts against Tomcat management consoles using commonly weak credentials, such as username “Tomcat” and password “123456” to gain initial access to vulnerable servers. Once compromised, the servers are quickly weaponized to steal SSH credentials, establish persistence, and hijack resources for cryptocurrency mining operations, demonstrating the attackers’ efficiency in leveraging newly discovered security flaws. A new sophisticated attack campaign targeting Apache Tomcat servers has emerged, with attackers deploying encrypted and encoded payloads designed to run on both Windows and Linux systems. After successfully guessing credentials on the Apache Tomcat management console, the attackers upload Java-based web shells that enable them to execute arbitrary code on the infected servers. Aquasec security researchers noted this campaign, dubbed “Tomcat Campaign 25′,” noting that the malware shows signs of being relatively new. Security researchers have discovered that it took just 30 hours for malicious actors to exploit a newly identified vulnerability in Apache Tomcat. The malware demonstrates advanced evasion capabilities, masquerading as legitimate kernel processes with names like “[cpuhp/0]” to avoid detection while optimizing CPU consumption for more efficient cryptocurrency mining operations. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. When visiting the malicious website users see what appears to be a standard “Page Not Found” error, while the actual malicious payload is concealed within the HTML code. Code snippets within the malware suggest possible connections to Chinese-speaking threat actors, though this could potentially be a misdirection technique employed by the attackers to obscure their true origin. The malware also deploys a cryptominer that connects to mining pools, effectively hijacking server resources as seen in Figure 1, which illustrates the complete attack flow. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. These web shells serve as backdoor loaders and establish persistence mechanisms that allow attackers to maintain access even after system reboots. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Apr 2025 13:15:19 +0000