Different attackers have installed cryptocurrency mining software, especially Monero, on various Oracle servers, which has allowed them to amass a large amount of cryptocurrencies.

Renato Marinho, a researcher at Morphus Labs, has published a report, in which he describes an exploit within the PeopleSoft and Weblogic servers, which allows cryptocurrency mining through a weakness in the Oracle servers, where these sites are hosted. This researcher has revealed that this critical vulnerability of Oracle, which allows an intruder, the execution of arbitrary commands within a system of privileges of the users of the Weblogic or PeopleSoft servers.

Despite the fact that a security patch has been developed that solves the vulnerability detected in October 2017, it has been known that the problem affects versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0. 10.3.3.0 and XNUMX from Oracle, which have not been updated. This vulnerability would allow anyone to steal information that is stored on the device, but the investigation has revealed that it has only been used for mining cryptocurrencies.

A parallel investigation by Johannes B. Ullrich for the SANS Technology Institute, claims to have managed to find data from a cryptocurrency mining software Xmrig, in this case. According to the data, a wallet designed to store all the mined has been found, where 611 Monero have been found, which is equivalent to almost $ 230.000. Marinho also found similar data, but mining AEON, which is equivalent to about $ 6.000.

These attacks have been happening since December of this past year. Oracle, after knowing everything that happened, has released different security tips and critical update patches for the protection of the systems used. Cryptocurrency miners are everywhere today, especially on torrent download websites, who have chosen to install these tools, instead of advertising, because it cannot be blocked.