{ "id": "ef6a28d2-86f7-4457-b18b-671c9a04fb97", "created_at": "2026-04-06T00:07:28.9718Z", "updated_at": "2026-04-10T03:38:06.298411Z", "deleted_at": null, "sha1_hash": "16e3b9f13547ea813c4a6bb992f55d0d83d80973", "title": "Hackers Exploiting Spring4Shell Vulnerability to Deploy Mirai Botnet Malware", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 293741, "plain_text": "Hackers Exploiting Spring4Shell Vulnerability to Deploy Mirai\r\nBotnet Malware\r\nBy The Hacker News\r\nPublished: 2022-04-09 · Archived: 2026-04-05 16:22:15 UTC\r\nThe recently disclosed critical Spring4Shell vulnerability is being actively exploited by threat actors to execute\r\nthe Mirai botnet malware, particularly in the Singapore region since the start of April 2022.\r\n\"The exploitation allows threat actors to download the Mirai sample to the '/tmp' folder and execute them after\r\npermission change using 'chmod,'\" Trend Micro researchers Deep Patel, Nitesh Surana, Ashish Verma said in a\r\nreport published Friday.\r\nTracked as CVE-2022-22965 (CVSS score: 9.8), the vulnerability could allow malicious actors to achieve remote\r\ncode execution in Spring Core applications under non-default circumstances, granting the attackers full control\r\nover the compromised devices.\r\nThe development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) earlier this week\r\nadded the Spring4Shell vulnerability to its Known Exploited Vulnerabilities Catalog based on \"evidence of active\r\nexploitation.\"\r\nhttps://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html\r\nPage 1 of 3\n\nThis is far from the first time the botnet operators have quickly moved to add newly publicized flaws to their\r\nexploit toolset. In December 2021, multiple botnets including Mirai and Kinsing were uncovered leveraging the\r\nLog4Shell vulnerability to breach susceptible servers on the internet. \r\nMirai, meaning \"future\" in Japanese, is the name given to a Linux malware that has continued to target connected\r\nsmart home devices such as IP cameras and routers and link them together into a network of infected devices\r\nknown as a botnet.\r\nThe IoT botnet, using the herd of hijacked hardware, can be then used to commit further attacks, including large-scale phishing attacks, cryptocurrency mining, click fraud, and distributed denial-of-service (DDoS) attacks.\r\nTo make matters worse, the leak of Mirai's source code in October 2016 has given birth to numerous variants such\r\nas Okiru, Satori, Masuta, and Reaper, making it an ever-mutating threat.\r\n\"The [Mirai] code is so influential that even some of the malware offshoots are starting to have their own code\r\nversions released and co-opted by other cybercriminals,\" Intel 471 researchers said last month, pointing out the\r\nupload of the BotenaGo botnet's source code on GitHub in January 2022.\r\nEarlier this January, cybersecurity firm CrowdStrike noted that malware hitting Linux systems increased by 35%\r\nin 2021 compared to 2020, with XOR DDoS, Mirai, and Mozi malware families accounting for more than 22% of\r\nLinux-targeted threats observed in the year.\r\nhttps://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html\r\nPage 2 of 3\n\n\"The primary purpose of these malware families is to compromise vulnerable internet-connected devices, amass\r\nthem into botnets, and use them to perform distributed denial-of-service (DDoS) attacks,\" the researchers said.\r\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content\r\nwe post.\r\nSource: https://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html\r\nhttps://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html" ], "report_names": [ "hackers-exploiting-spring4shell.html" ], "threat_actors": [ { "id": "6f30fd35-b1c9-43c4-9137-2f61cd5f031e", "created_at": "2025-08-07T02:03:25.082908Z", "updated_at": "2026-04-10T02:00:03.744649Z", "deleted_at": null, "main_name": "NICKEL FOXCROFT", "aliases": [ "APT37 ", "ATK4 ", "Group 123 ", "InkySquid ", "Moldy Pisces ", "Operation Daybreak ", "Operaton Erebus ", "RICOCHET CHOLLIMA ", "Reaper ", "ScarCruft ", "TA-RedAnt ", "Venus 121 " ], "source_name": "Secureworks:NICKEL FOXCROFT", "tools": [ "Bluelight", "Chinotto", "GOLDBACKDOOR", "KevDroid", "KoSpy", "PoorWeb", "ROKRAT", "final1stpy" ], "source_id": "Secureworks", "reports": null }, { "id": "a6c351ea-01f1-4c9b-af75-cfbb3b269ed3", "created_at": "2023-01-06T13:46:39.390649Z", "updated_at": "2026-04-10T02:00:03.311299Z", "deleted_at": null, "main_name": "Kinsing", "aliases": [ "Money Libra" ], "source_name": "MISPGALAXY:Kinsing", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "9b02c527-5077-489e-9a80-5d88947fddab", "created_at": "2022-10-25T16:07:24.103499Z", "updated_at": "2026-04-10T02:00:04.867181Z", "deleted_at": null, "main_name": "Reaper", "aliases": [ "APT 37", "ATK 4", "Cerium", "Crooked Pisces", "G0067", "Geumseong121", "Group 123", "ITG10", "InkySquid", "Moldy Pisces", "Opal Sleet", "Operation Are You Happy?", "Operation Battle Cruiser", "Operation Black Banner", "Operation Daybreak", "Operation Dragon messenger", "Operation Erebus", "Operation Evil New Year", "Operation Evil New Year 2018", "Operation Fractured Block", "Operation Fractured Statue", "Operation FreeMilk", "Operation Golden Bird", "Operation Golden Time", "Operation High Expert", "Operation Holiday Wiper", "Operation Korean Sword", "Operation North Korean Human Right", "Operation Onezero", "Operation Rocket Man", "Operation SHROUDED#SLEEP", "Operation STARK#MULE", "Operation STIFF#BIZON", "Operation Spy Cloud", "Operation Star Cruiser", "Operation ToyBox Story", "Osmium", "Red Eyes", "Ricochet Chollima", "Ruby Sleet", "ScarCruft", "TA-RedAnt", "TEMP.Reaper", "Venus 121" ], "source_name": "ETDA:Reaper", "tools": [ "Agentemis", "BLUELIGHT", "Backdoor.APT.POORAIM", "CARROTBALL", "CARROTBAT", "CORALDECK", "Cobalt Strike", "CobaltStrike", "DOGCALL", "Erebus", "Exploit.APT.RICECURRY", "Final1stSpy", "Freenki Loader", "GELCAPSULE", "GOLDBACKDOOR", "GreezeBackdoor", "HAPPYWORK", "JinhoSpy", "KARAE", "KevDroid", "Konni", "MILKDROP", "N1stAgent", "NavRAT", "Nokki", "Oceansalt", "POORAIM", "PoohMilk", "PoohMilk Loader", "RICECURRY", "RUHAPPY", "RokRAT", "SHUTTERSPEED", "SLOWDRIFT", "SOUNDWAVE", "SYSCON", "Sanny", "ScarCruft", "StarCruft", "Syscon", "VeilShell", "WINERACK", "ZUMKONG", "cobeacon" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434048, "ts_updated_at": 1775792286, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/16e3b9f13547ea813c4a6bb992f55d0d83d80973.pdf", "text": "https://archive.orkl.eu/16e3b9f13547ea813c4a6bb992f55d0d83d80973.txt", "img": "https://archive.orkl.eu/16e3b9f13547ea813c4a6bb992f55d0d83d80973.jpg" } }