The researchers reported the issue in a blog, discussing the group’s attack tactics, recent activities, and indicators of compromise (IoCs) from the threat actor’s most recent campaign. Customers of Imperva are shielded from the known actions of this group. All firms are required to keep their security and patching up-to-date.
History of the Threat Actor
The 8220 gang, which is believed to be a China-based group, was initially discovered in 2017 by Cisco Talos. The targets include Apache Struts2, Hadoop YARN, and Drupal systems, where the threat actors transmitted cryptojacking malware. Since then, a number of additional researchers have offered updates on the group’s growing tactics, methods, and procedures (TTPs), which include making use of vulnerabilities in Log4j and Confluence. The group’s use of the Oracle WebLogic vulnerability CVE-2017-3506 to infect specific systems was most recently shown b
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.