Thread: Analysis of a Real JBOSS Hack

Tweet

This is an analysis of a recent attack observed on a on a large enterprise network. The attackers compromised multiple servers via JBOSS JMX console vulnerabilities. With this access they were able to install tools for remote access and transmit data from the enterprise network to their C&C systems. The attack, while not sophisticated, demonstrates some of the techniques used by the hackers and burns their IP addresses that were used. We will discuss the attack and our methodology for the detection and response.

Read the full analysis hereAnalysis of a Real JBOSS Hack - 9b+