An unknown attacker is exploiting weak passwords to break into Oracle WebLogic servers and deploy an emerging Linux malware called Hadooken, according to researchers from cloud security outfit Aqua.
Aqua caught the malware in a honeypot WebLogic server.
The first payload runs a shell script called "c" and a Python script called "y" – both of which attempted to download Hadooken.
Aqua traced the downloaded Hadooken malware back to two IP addresses.
Aqua also wrote that its researchers’ analysis of the Hadooken binary suggests links to the RHOMBUS and NoEscape ransomware strains.

'Hadooken' Linux malware targets Oracle WebLogic servers