Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Chinese-linked Muhstik Botnet Targets Oracle WebLogic, Drupal

Chinese-linked Muhstik Botnet Targets Oracle WebLogic, Drupal

Muhstik botnet, also known as Mushtik, has been targeting cloud infrastructure and IoTs for years.

The botnet mainly funds itself by mining cryptocurrency using open source tools like XMRig and cgminer.

New details have emerged related to this malware that shed light on its nefarious activities and origins.

What is Muhstik?

Muhstik is a botnet that leverages known web application exploits to compromise IoT devices, such as routers, to mine cryptocurrency.

It leverages IRC servers for its command-and-control (C2) activities.

Although Muhstik botnet has been around for at least 2018, in December 2019, Palo Alto Networks had identified a new variant of the botnet attacking and taking over Tomato routers. 

Some of the vulnerabilities exploited by Muhstik include Oracle WebLogic Server bugs (CVE-2019-2725 and CVE-2017-10271) and Drupal RCE flaw (CVE-2018-7600).

Now, cloud security firm Lacework has provided some additional analysis and observations related to Muhstik.

A Muhstik attack executes in multiple stages.

Also Read: The Scope Of Singapore Privacy: How We Use It In A Right Way

Firstly, a payload file with name “pty” followed by a number is downloaded from the attacker’s server. Example URLs provided by Lacework include:


“Upon successful installation Mushtik will contact the IRC channel to receive commands,” says Chris Hall, cloud security researcher at Lacework.

The IRC servers are the C2 infrastructure powering the Muhstik botnet.

“Usually Muhstik will be instructed to download an XMRrig miner and a scanning module. The scanning module is used for growing the botnet through targeting other Linux servers and home routers,” Hall continued.

Muhstik uses Mirai source code to encrypt the configurations of its payload and scanning module through single-byte XOR encryption.

Lacework explains file samples containing Muhstik configuration data tend to contain the following byte sequence: 4F 57 4A 51 56 4B 49 0F.

This is the XOR’d (by 0x22) equivalent value of the “muhstik” keyword which can be identified in unpacked binaries.

Weird attribution and ‘anime’ references

However, more interesting details emerge when Lacework researchers attempt to trace the botnet’s origins.

“IRC C2 was found to be sharing an SSL cert with site,” explains Hall.

“ is an amateur site about a game involving an Anime character named ‘Jay’. The site is currently leveraging Google Analytics ID UA-120919167-1.”

This analytics ID has been found to be associated with other two domains: and

In tests by BleepingComputer, we observed the stated Analytics ID to indeed be present on but no longer on the other two domains.

Google Analytics ID present on domain
Source: BleepingComputer

However, it is worth noting anyone, including a malicious actor, can include a Google Analytics ID of a legitimate website into their own website. 

Another domain with references to anime used by Muhstik is Whereas, Kei (in could be a reference to an anime character too, according to Lacework.

By tracking similar correlations, Lacework traced the origin of Muhstik to a Chinese forensics firm.

“These all have links to the same malware upload path belonging to Chinese forensics firm Shen Zhou Wang Yun Information Technology Co., Ltd,” explains their blog post.

Muhstik correlations observed by Lacework

Additionally, Lacework mentions the original malware samples were uploaded to VirusTotal all at once before Muhstik attacks were observed in the wild.

Also Read: Deemed Consent PDPA: How Do Businesses Comply?

These samples had multiple strings mentioning “shenzhouwangyun,” such as in /home/wys/shenzhouwangyun/shell/downloadFile/tomato.deutschland-zahlung.eu_nvr

This indicates, “Shen Zhou Wang Yun is likely the malware originator and not simply the first uploader,” suggested Hall.

In the past, researchers have also linked Shen Zhou Wang Yun to the HiddenWasp Linux malware.

Muhstik’s up to date Indicators of Compromise (IOCs) have been provided in a CSV by Lacework.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us