Descubra 5 motivos para dominar JBoss/WildFly: valorize seu currículo, facilite integrações, acesse materiais gratuitos e impulsione seu futuro em TI.

# Java Application Servers Are Still the Internet's Largest Exposed Estate ZoomEye measurements taken on 26 September 2026 put three enterprise Java platforms well inside the top tier of internet-reachable application servers. The dork app="JBoss" returned 8,741,336 matches, app="WebLogic" returned 1,335,265 and app="WildFly" returned 285,121. Those are single-query totals from ZoomEye captured at the same time. They count hosts whose responses allow the platform to be identified, not hosts confirmed to run a specific vulnerable release. ## Context and method All counts in this article come from ZoomEye queries executed through the platform API on 26 September 2026 at 00:34 China Standard Time. Each dork was submitted as a single query, one page, one result per page, with the sub_type parameter set to all. That configuration limits the number of records returned in the response, not the total the platform reports as matched. A count of this kind answers one question: how many hosts on the public internet present a fingerprint consistent with that product. It does not answer whether a given host is patched, whether it is a honeypot, or whether the management interface is exposed alongside the application. Treating a fingerprint total as an inventory of vulnerable systems overstates the risk. Treating it as noise understates it. ## What the numbers suggest The gap between JBoss and WildFly is the most interesting part of the set. WildFly is the current name of the application server that JBoss Community distributions once carried, so a large JBoss fingerprint count alongside a smaller WildFly count points to long-lived deployments that have not been renamed, re-installed or replaced. Enterprise Java middleware has a service life measured in a decade or more, so the installed base accumulates instead of turning over. That character shapes the security problem. These platforms are rarely placed in front of the internet for public traffic. They sit behind a reverse proxy or load balancer, or were exposed temporarily for an integration and never moved back. Their management surfaces, including administrative consoles and JMX-style endpoints, tend to be far more powerful than a public web application, because their intended operators are trusted administrators. ## What the exposure means in practice The relevant risk is the combination of an internet-reachable management interface with a component that can deploy code, not the application server on its own. Where a console is reachable and reachable with weak or default credentials, the result is effectively remote code execution with a graphical interface. Historical Java middleware vulnerabilities have followed this pattern repeatedly, and each one is a variation on the same theme. ZoomEye data is useful here because the fields captured alongside an IP address often include the response title and banner. A host presenting a WebLogic console title is a different proposition from one presenting an application error page. Reviewing those fields, rather than only the totals, is what turns a count into an actionable list. ## Implications and next steps Start by listing Java middleware assets that are reachable from outside the organisation, then check whether the management path is reachable from the same range. Where it is, restricting access to an administrative network is a change that takes minutes and removes most of the practical risk while patching is scheduled. For platform teams the useful measurement is how many hosts run a release that no longer receives upstream fixes, not how many run JBoss or WebLogic. A count that includes end-of-life releases is the one that should drive the upgrade queue. ## Scope and limitations These figures are point-in-time counts of fingerprint matches. They include hosts belonging to hosting providers, security research ranges and honeypot networks, and they include the same organisation counted many times where deployments are per-tenant. They do not measure exploitation or patching status. ZoomEye fingerprinting identifies a product from observable responses, so a hardened host that suppresses banners will not appear even if it runs the platform. ## References * ZoomEye search API results for app="JBoss", app="WebLogic" and app="WildFly", collected 26 September 2026.

🚨あまり👉 知られて居ない事実🚨 千葉県の「ガス田」は、実は日本でも非常に特徴的な資源です。 ⛽️【千葉県の地下に眠る巨大資源】 ✅千葉県を中心に広がる「南関東ガス田」は、日本最大の水溶性天然ガス田。 🔹可採埋蔵量：約3,685億㎥ 🔹主成分：約99％がメタン 🔹九十九里地域を中心に生産 🔹地下の「かん水」に天然ガスが溶けている 🔹かん水には高濃度のヨウ素も含まれる ⚠️つまり千...

Descubra 5 motivos para dominar JBoss/WildFly: valorize seu currículo, facilite integrações, acesse materiais gratuitos e impulsione seu futuro em TI.

Descubra 5 motivos para dominar JBoss/WildFly: valorize seu currículo, facilite integrações, acesse materiais gratuitos e impulsione seu futuro em TI.

Descubra 5 motivos para dominar JBoss/WildFly: valorize seu currículo, facilite integrações, acesse materiais gratuitos e impulsione seu futuro em TI.

## 1. Basic Information * **Article Title** : Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America * **Source** : Unit 42 * **Publication Date** : 2026-09-03 * **Original Link** : Unit 42 * **Related Sources** : Trend Micro Vibe Hacking report * **Related Malware, Threat Groups, CVEs, and Products** : CL-CRI-1131, CL-CRI-1163, SockTz, NextChat, Windows, JBoss AS * **Severity** : High * **Review Update** : Content reviewed on 2026-09-05. Clarified SockTz attempts and connection success status, evaluation entities for AI usage and failure reasons, baseless infrastructure-sharing hypotheses, and observations from both attacker and victim environments. Updated Japanese phrasing and adjusted "Visibility for Victims and Administrators" to clearly describe events appearing in screens, logs, and devices along with their observation conditions. Regional assumptions were removed from "Impact on SOCs," which was refactored into general lessons for global SOCs and enterprises regarding tracking retries, distinguishing attempts from successes, and leveraging attacker infrastructure analysis. The entire section is presented as analysis, omitting paragraph-level Inference labels to maintain concise text, and standardized to polite declarative forms. ## 2. Executive Summary Separate intrusion campaigns targeting Mexico and Brazil showed repeated use of scripts and SockTz. Unit 42 assesses that the attackers used LLM assistance based on repeated modifications and related infrastructure analysis, but successful SockTz connections are not explicitly confirmed in the text. ## 3. Attack Flow ### Data Collection and Related Infrastructure by the Mexican Campaign Group 1. On already compromised Windows endpoints, attackers repeatedly attempt to acquire SAM and NTDS.dit. 2. Facing difficulties in acquisition, they create Volume Shadow Copies across multiple drives and attempt to copy the files. 3. Using sequential batch scripts, they collect data while adding checks for write permissions at the destination. 4. Unit 42 observed activities coordinating a connection to 62.171.185[.]97 for data exfiltration, tracking related infrastructure via DuckDNS domains and TLS certificates. Successful external transmission of individual files or the full scope of theft requires separate verification. ### SockTz Deployment Attempts by the Brazilian Financial Campaign Group 1. In the case cited by Unit 42, initial access occurred via an attachment in a phishing email disguised as a resume. 2. After deploying multiple RATs, attackers attempt to deploy SockTz versions 1 through 8 from a compromised WordPress site. 3. They change the download source to an attacker-managed server to retrieve version 9. Unit 42 infers that deployment or connection failures were the reason. 4. Deployment attempts for versions 1 through 9 continued for approximately two hours. SockTz is a tool that provides reverse SOCKS5 connections, but successful connection after acquiring version 9 is not explicitly stated in the text. ## 4. Attacker Position and Execution Location * External attackers who can already execute code on Windows endpoints. Collection scripts, RATs, and SockTz run within the victim environment. * In the case documented for CL-CRI-1163, resume-disguised attachments served as the initial entry vector. * NextChat and public file listings reside on the attacker's related infrastructure. They are not treated as LLMs or management interfaces on victim endpoints. ## 5. Visibility for Victims and Administrators ### Victims * In the Brazilian case, victims receive phishing email attachments disguised as resumes. * Inference: Victims may notice no obvious screen changes after opening the attachment and might remain unaware of RAT or tunnel deployment attempts. ### Administrators * Inference: If EDR and other tools collect process and file access data, evidence corresponding to the Mexican campaign group may appear chronologically, including vssadmin execution, access to SAM and NTDS.dit, and the execution of sequential batch scripts. These logs alone do not confirm successful credential harvesting or external exfiltration. * Inference: In the Brazilian campaign case, process, file, and network logs may show repeated acquisition of socktz_v*.exe via certutil and changes in the download source. Acquisition and startup logs alone do not indicate successful tunnel connection. * Inference: If SockTz runs and attempts a connection, process startups and outbound connection attempts/results may remain in EDR logs depending on collection settings. * TCP 3000 for NextChat was observed on attacker infrastructure and does not imply that communication from the victim endpoint to that destination was observed. ## 6. Success and Failure Conditions ### Success Conditions * Ability to execute commands on compromised endpoints. * Privileges allowing access to targets are required to collect credential files and business data. * Outbound connectivity must be established to retrieve tools from outside and proceed with tunneling. Deployment attempts alone do not mean connection success. ### Failure Conditions and Risk Mitigation * Inference: Restrict management tool privileges and limit access to SAM, NTDS.dit, and shadow copies. Apply credential protection measures after verifying protected assets, rather than assuming it universally prevents file theft on disk. * Inference: Restrict unauthorized scripts and executables using application control. * Inference: Restrict communications to suspicious dynamic DNS, unknown IP addresses, and unauthorized tunnels using outbound traffic allowlists. ## 7. What Happens Upon Success * If successful, credentials such as SAM and NTDS.dit or sensitive data may be collected and exfiltrated externally. Confirm individual acquisition and exfiltration success through execution results. * Inference: If a reverse SOCKS5 connection is established, it can be used for persistent access and lateral movement within the compromised environment. Do not treat deployment attempts described in this article as evidence of successful connection or lateral movement. ## 8. Observable Logs * **Email** : Records of the resume-disguised attachment, its retrieval, opening, and execution. * **Proxy/SWG/DNS** : Verify communications related to DuckDNS domains, 62.171.185[.]97, 178.128.87[.]160, 167.148.195[.]53, and the compromised WordPress site, distinguishing roles and timestamps. Do not assume all communications from victim endpoints to IPs listed in attacker infrastructure have been observed. * **Endpoint/EDR** : Execution results of vssadmin, access to SAM and NTDS.dit, sequential batch scripts, certutil, socktz_v*.exe, and RAT execution. * **Identity/IdP** : Inference: Check for suspicious directory queries from compromised endpoints or unauthorized use of potentially acquired credentials. * **SaaS/Cloud** : Usage history of attacker-controlled NextChat or commercial LLMs is typically not obtainable as victim organization logs. When acquired via public research or authorized provisioning, keep it separate from victim environment observations. * **Network** : Inference: Check retrieval from 167.148.195[.]53:8888, outbound SockTz connections, long-duration communications, and their success or failure. NextChat on TCP 3000 was confirmed on the attacker side and does not require victim organization connections. ## 9. Attack Success Determination The following criteria are guidelines for investigating individual environments and do not mean that success at all stages was observed in the article. * **Attack Attempt Observed (Success Unconfirmed)** : Confirm only phishing attachments or tool retrieval. If evidence shows command execution was used for retrieval, record that execution separately, but distinguish it from tool execution or tunnel success. * **User Action Confirmed** : Confirm that the victim user opened the attachment. If code execution is confirmed, evaluate it as initial execution. * **Initial Execution Confirmed** : Confirm execution of attack-related batch scripts, vssadmin, certutil, etc. Determine separately via outputs and artifacts whether each command succeeded in its intended process. * **Malware Execution or Authentication Success Confirmed** : Confirm execution of RATs or SockTz through process and behavioral evidence. Confirm C2 and proxy connection success via network results; execution or retrieval alone does not constitute success. * **Data Theft or Session Compromise Confirmed** : Confirm unauthorized acquisition and exfiltration of SAM, NTDS.dit, or business data through copy artifacts or transmission content. Acquisition command execution or connection attempts alone are not conclusive. * **Subsequent Compromise Confirmed** : Confirm unauthorized connection to internal targets via SOCKS5 or actual lateral movement. Tunnel deployment and connection alone do not determine successful lateral movement. ## 10. Investigation Playbook Inference: Investigation proposals based on article observations and functional descriptions. * **Trigger** : Combination of shadow copy creation, credential access, and sequential scripts, or repeated SockTz retrieval following RAT deployment. Do not require all characteristics of separate campaigns to appear on a single endpoint. * **Initial Verification** : Preserve endpoint timelines, parent-child processes, sources, outbound connections, and their success/status. For the Brazilian case, check initial phishing emails. * **Endpoints** : Examine Temp or user directories for batch/PowerShell scripts, RATs, socktz_v*.exe, shadow copies, and command execution results. * **Authentication/Cloud** : Examine potential use of compromised credentials and directory queries. Investigate misuse of organizational LLM accounts only when evidence exists, and do not assume attacker-side NextChat appears in internal logs. * **Subsequent Actions** : Track internal scanning, remote service usage, pre-exfiltration data aggregation, and external transmission. Verify success of tunnel-based internal connections. * **Containment** : Isolate endpoints, block malicious communication destinations, rotate potentially exposed credentials, and remove malicious tools. * **Classification of Findings** : Separate failed attempts, code execution, successful tunnel connections, credential acquisition, exfiltration, and lateral movement. ## 11. Defense and Detection Ideas Inference: Operational application proposals below. Do not conclude successful compromise based solely on matching individual logs or IOCs. * **Single Event** : Attempted NTDS.dit copy following vssadmin execution. * **Single Event** : Retrieval of socktz_v*.exe via certutil. * **Timeline Correlation** : Correlate sequential script execution -> shadow copy creation -> credential file access -> data aggregation -> outbound communication. For SockTz, track retrieval repetitions, execution, and connection results. * **Hunting** : Search for article IOCs and similarly named scripts or executables created in the same directory within a short timeframe. Record attacker infrastructure IOCs separately from communications actually observed on victim endpoints. * **Log Gaps** : Lack of command line, execution result, file access, DNS, and outbound communication logs makes it difficult to distinguish attempts from successes. Even with complete records, this does not confirm AI assistance. * **Priority Actions** : Prioritize credential protection, application control, outbound traffic restriction, and logging of scripts and execution results. ## 12. Facts / Inference / Hypothesis ### Facts * Unit 42 tracks CL-CRI-1131 (targeting transport organizations, federal ministries, and municipal water utilities in Mexico) and CL-CRI-1163 (targeting the Brazilian financial sector) as distinct intrusion campaigns. * In CL-CRI-1131, after struggling to acquire SAM and NTDS.dit, attackers were observed creating Volume Shadow Copies across multiple drives and advancing data collection while modifying sequential batch scripts. * IP 178.128.87[.]160 associated with CL-CRI-1131 hosted NextChat on TCP 3000. Referencing related external reports, Unit 42 evaluates LLM usage based on handling collection failures and analyzing this infrastructure. * In the CL-CRI-1131 case, intrusion occurred via a resume-disguised attachment. After deploying multiple RATs, attackers attempted to deploy SockTz, a Go-based reverse SOCKS5 tool. * SockTz deployment attempts for versions 1 through 9 lasted about two hours, with download sources shifting from a compromised WordPress site to an attacker-managed server. * Unit 42 indicates that this download source change may have been due to SockTz deployment or proxy connection failures. Whether connection succeeded after acquiring version 9 is not explicitly stated in the text. * Public file listings include exploit_creative.py, exploit_careful.py, and rce_focused.py, which Unit 42 evaluates as material suggesting LLM generation based on naming conventions and iterative modifications. Do not treat filenames alone as definitive proof of AI usage. ### Inference * Humans may have iteratively modified scripts while reviewing LLM outputs and execution results. However, the level of autonomous privilege granted to the AI or the extent of human intervention cannot be determined from this article. * Correlating sequential scripts or repeated tool retrievals with credential access and external communications aids investigations. These behaviors alone do not identify the presence of AI assistance. ### Hypothesis No additional hypotheses. Unconfirmed items are listed in "Unanswered Questions and Further Investigation." ## 13. MITRE ATT&CK Mapping * **T1059.003 Command and Scripting Interpreter: Windows Command Shell (High)** : Repeatedly executed sequential batch scripts. * **T1003.003 OS Credential Dumping: NTDS (High)** : Attempted to acquire NTDS.dit. Verify acquisition and exfiltration success for individual attempts separately. * **T1090.001 Proxy: Internal Proxy (Medium)** : Candidate response when SockTz targets relaying from compromised environments to internal targets. Deployment attempts were observed, but connection/relay success is not explicitly stated in the text. * **T1105 Ingress Tool Transfer (High)** : Acquired SockTz using certutil and other tools. ## 14. Unanswered Questions and Further Investigation * Attribution and interrelationship between CL-CRI-1131 and CL-CRI-1163. Similar structures alone do not confirm shared infrastructure, collaboration, or the same threat actor. * Scope of data successfully acquired and exfiltrated in individual attempts, and the number of victim organizations. * Connection success after acquiring SockTz version 9 and the presence of actual relaying or lateral movement. * Victim organization data provided to LLMs, utilized accounts, and the extent of human intervention. ## 15. Impact on SOCs and Organizations A key lesson for SOCs is to view attacker trial-and-error as an interconnected chain of events. In the Mexican campaign, sequential scripts were observed; in the Brazilian campaign, repeated SockTz acquisitions and download source changes were noted. Capturing these actions requires tracking processes, files, and communications on the same endpoint chronologically rather than stopping investigations after single failures. Detecting access to credential files or unauthorized tool execution allows investigations to proceed even before AI usage can be confirmed. Assessing damage requires preserving command execution results, generated files, and connection outcomes. Separating records of tool acquisition and execution from evidence of successful credential theft or tunnel connection makes it easier to determine response actions based on verified impact. Information gained from investigating attacker infrastructure can also aid internal investigations. In this article, related infrastructure was analyzed using public file listings and TLS certificates. Matching domains and IP addresses derived from this analysis against historical DNS and communication records may help narrow down endpoints requiring further investigation. However, the mere presence of NextChat confirmed on the attacker side does not determine that connections originated from victim endpoints. ## 16. Summary by Target Audience * **For SOCs** : Review vssadmin, SAM/NTDS.dit acquisition attempts, sequential scripts, certutil acquisitions, and SockTz execution/connection results chronologically. Distinguish attempts from successes. * **For Administrators** : Restrict access to credential files, enforce script and application controls, and limit outbound traffic. Separate observations of attacker-side NextChat from victim environment monitoring. * **For Users** : Avoid opening resume attachments indiscriminately and report suspicious executions or warnings.

Descubra 5 motivos para dominar JBoss/WildFly: valorize seu currículo, facilite integrações, acesse materiais gratuitos e impulsione seu futuro em TI.

Descubra 5 motivos para dominar JBoss/WildFly: valorize seu currículo, facilite integrações, acesse materiais gratuitos e impulsione seu futuro em TI.

Posted by disclosure via Fulldisclosure on Aug 170day Rubbish Research Team is publicly disclosing a vulnerability in RapidDeploy 5.2.2 (MidVision). The research is published and a proof-of-concept is available. Pre-authentication RCE (arbitrary file write) (CVSS 9.8, pre-authentication) MidVision RapidDeploy 5.2.2 ships a remote-agent template (midvision-remoting-server.xml) with host=0.0.0.0 and auth.servers commented out, making the JBoss Remoting layer network-reachable with no...

Descubra 5 motivos para dominar JBoss/WildFly: valorize seu currículo, facilite integrações, acesse materiais gratuitos e impulsione seu futuro em TI.

The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…

CVE-2026-10579 is a critical authentication bypass vulnerability in the Picketlink Federation SAML component of Red Hat JBoss Enterprise Application Platform 7. The flaw resides in the unsolicited response handler, which improperly accepts

Picketlink Federation SAML is affected, allowing an unauthorized attacker to impersonate users and access sensitive information or restricted functions.

A pre-auth flaw in Undertow (CVE-2026-15565), the web server in Red Hat JBoss EAP and Data Grid, lets an attacker exhaust memory and crash the server.

Descubra 5 motivos para dominar JBoss/WildFly: valorize seu currículo, facilite integrações, acesse materiais gratuitos e impulsione seu futuro em TI.