APACHE APPLICATIONS TARGETED BY STEALTHY ATTACKER

Summary from the TLDR InfoSec newsletter

Researchers have identified attacks exploiting Apache Hadoop and Flink misconfigurations to deploy crypto miners. The malware uses packers and rootkits to hide, delete contents, and modify configs for evasion. Hadoop attacks abuse a YARN ResourceManager misconfiguration, allowing remote code execution via crafted requests and Flink attacks similarly to achieve unauthenticated remote code execution by targeting a misconfiguration.