8220 Gang: Unleashing Malware through Oracle WebLogic Server Vulnerability

The 8220 Gang, a threat actor group, has been exploiting a vulnerability in Oracle WebLogic Server to spread malware. The vulnerability, known as CVE-2020-14883, is a high-severity flaw that allows authenticated attackers to execute code on susceptible servers. The group has a history of leveraging security flaws to distribute cryptojacking malware and has previously targeted Oracle WebLogic servers. Recent attack chains observed by security researchers involve the exploitation of CVE-2020-14883 to deploy stealer and coin mining malware. The group targets various industries and countries, including healthcare, telecommunications, and financial services sectors in the U.S., South Africa, Spain, Columbia, and Mexico. Although considered unsophisticated, the group constantly evolves its tactics to evade detection.