new botnet malware

How Exposed JDWP Interfaces and Hpingbot Malware Are Fueling Crypto Mining and DDoS Attacks Security experts warn of growing cyber threats as exposed JDWP interfaces are exploited for cryptomining, while a new malware strain, Hpingbot, targets weak SSH setups for DDoS attacks. Introduction In today’s evolving threat landscape, exposed JDWP interfaces and misconfigured systems are becoming key targets for cybercriminals. Recent reports from leading cybersecurity firms reveal that attackers are leveraging these vulnerabilities to install cryptocurrency miners and deploy new botnet malware like Hpingbot for large-scale DDoS (Distributed Denial of Service) attacks. These threats highlight the urgent need for organizations to secure their development environments and remote access protocols. JDWP: A Silent Threat in Java Development The Java Debug Wire Protocol (JDWP) is a standard Java interface used to facilitate debugging. While valuable for developers, JDWP lacks proper authentication or access controls when exposed, making it a dangerous attack vector. Cybersecurity researchers at Wiz identified active exploitation of exposed JDWP interfaces on honeypot servers running TeamCity, a popular CI/CD tool. These misconfigured interfaces allowed threat actors to execute arbitrary commands, drop cryptocurrency miners, and establish persistence on compromised machines. How the JDWP Attack Works Here’s how attackers weaponize JDWP: Scan for open JDWP ports (usually 5005) Confirm access using JDWP-Handshake Use a curl command to download a malicious shell script Drop a modified XMRig miner with hardcoded settings Set up cron jobs for persistence Delete traces of infection Notably, attackers use mining pool proxies to hide wallet addresses and avoid detection by standard security tools. Wiz warns that while JDWP isn’t active by default, many tools like Jenkins, Elasticsearch, Quarkus, Spring Boot, and Apache Tomcat can launch JDWP servers during debugging, often without alerting developers to the risks. Widespread Scanning and Exploitation According to GreyNoise, over 2,600 IPs have scanned for JDWP endpoints in the last 24 hours. Among these: 1,500+ IPs are confirmed malicious Most originate from China, the U.S., Germany, Singapore, and Hong Kong This shows how widespread the interest is in exploiting these exposed interfaces. Hpingbot: A New DDoS Botnet Emerges In parallel, a new malware called Hpingbot is targeting Linux and Windows systems with weak SSH configurations. Built from scratch, Hpingbot uses the hping3 utility to flood targets with customized ICMP/TCP/UDP packets. Security researchers from NSFOCUS have observed: Hpingbot spreads via SSH password spraying It uses Pastebin as a dead drop for DDoS instructions Main targets include Germany, the U.S., and Turkey It clears command history and maintains persistence Unlike typical Mirai-based botnets, Hpingbot is an original strain, showing innovation and stealth. The botnet’s modular structure allows attackers to load new components—some with built-in DDoS flood features, bypassing Pastebin and hping3 altogether. Malware Capabilities and Payloads The malicious shell script Hpingbot uses performs the following: Detects system architecture Kills existing malware or CPU-intensive processes Fetches and installs the DDoS payload Erases command history to hide its tracks Interestingly, even though hping3 can’t be used on Windows, attackers continue to deploy the malware, likely to leverage its ability to download and run arbitrary payloads, potentially turning infected systems into a larger malware distribution network. Key Takeaways and Protection Tips Never expose JDWP interfaces to the internet. Use firewalls and authentication. Harden SSH configurations. Disable password login where possible and use key-based authentication. Monitor high CPU usage. This may indicate hidden cryptominers. Patch and update regularly. Especially Java-based and SSH-accessible applications. Use honeypots and intrusion detection. Proactively detect scanning and attack attempts. Conclusion The rise of exposed JDWP interfaces and the emergence of new malware like Hpingbot show that attackers are adapting rapidly. With development tools and remote access systems in their crosshairs, businesses must stay vigilant, secure misconfigurations, and implement proactive cybersecurity measures. Concerned about vulnerabilities in your infrastructure?BlueFactor offers expert U.S.-based cybersecurity services to secure your endpoints, development tools, and network from evolving threats. Contact us today to learn how we can help protect your systems from cryptominers, DDoS botnets, and other advanced attacks.