In a report published on January 7 by SANS Technology Institute, Morphus Labs researcher Renato Marinho revealed what appears to be an ongoing worldwide hacking campaign by multiple attackers against PeopleSoft and WebLogic servers that leverages a Web application server vulnerability patched by Oracle late last year.

These attackers aren't stealing data from victims, however—at least as far as anyone can tell. Instead, the exploit is being used to mine cryptocurrencies. In one case, according to analysis posted today by SANS Dean of Research Johannes B. Ullrich, the attacker netted at least 611 Monero coins (XMR)—$226,000 dollars' worth of the cryptocurrency.

The attacks appear to have leveraged a proof-of-concept exploit of the Oracle vulnerability published in December by Chinese security researcher Lian Zhang. Almost immediately after the proof of concept was published, there were reports of it being used to install cryptominers from several different locations—attacks launched from servers (some of them likely compromised servers themselves) hosted by Digital Ocean, GoDaddy, and Athenix.

"The victims are distributed worldwide," wrote Ullrich. "This isn’t a targeted attack. Once the exploit was published, anybody with limited scripting skills was able to participate in taking down WebLogic/PeopleSoft servers."

In the case of the attack documented by Marinho, the attacker installed a legitimate Monero mining software package called xmrig on 722 vulnerable WebLogic and PeopleSoft systems—many of them running on public cloud services, according to Ulrich. More than 140 of those systems were in the Amazon Web Services public cloud, and smaller numbers of servers were on other hosting and cloud services—including roughly 30 on Oracle's own public cloud service.

The exploit code makes scanning for vulnerable systems simple, so the entire universe of publicly exposed, unpatched Oracle Web application servers could quickly fall victim to these and other attacks. On the bright side, some of these surreptitious mining efforts were detected relatively quickly because the script used to "drop" the mining tool also killed the "java" process on the targeted servers—essentially shutting down the application server and drawing quick attention from administrators.

The installer used in the documented Monero attack was a simple bash script. It issues commands to seek out and kill other blockchain miners that may have arrived before it, and it sets up a CRON job to download and launch the miner tool in order to keep its foothold intact.

Ullrich warned that victims shouldn't simply end their response to these intrusions by patching their servers and removing the mining software. "It is very likely that more sophisticated attackers used this to gain a persistent foothold on the system. In this case, the only 'persistence' we noticed was the CRON job. But there are many more, and more difficult to detect, ways to gain persistence."