VORANT. Threat Intelligence Research Sign in Create a free account

Hitachi Energy Service Suite deserialization RCE

high vulnerability energy

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Deserialization flaw in Hitachi Energy Service Suite allows unauthenticated remote code execution on Oracle WebLogic Server.

A deserialization of untrusted data vulnerability (CVE-2020-2883) affects Hitachi Energy Service Suite versions prior to 9.6.0.4 EP4. The flaw allows an unauthenticated attacker with network access to compromise the underlying Oracle WebLogic Server via the IIOP or T3 protocols, achieving complete system takeover with impact to confidentiality, integrity, and availability. Attack complexity is low and no user interaction is required.

Hitachi Energy recommends immediate patching to version 9.8.2 or the latest available release. Organizations should prioritize this update given the critical nature of the vulnerability (CVSS 9.3) and its deployment in energy sector infrastructure worldwide. CISA reports no known public exploitation of this specific vulnerability at present, but defenders should treat it as a high-priority patch given the ease of exploitation and the sensitivity of affected systems.

Mentioned in this report

Vulnerabilities CVE-2020-2883KEV

Related reporting

Detection guidance

WebLogic Java Process Spawning Windows Shell

ATT&CK T1190

Oracle WebLogic JVM spawning cmd or PowerShell, typical of post-exploitation of T3/IIOP deserialization RCE such as CVE-2020-2883. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: WebLogic Java Process Spawning Windows Shell
description: Detects a java.exe process running Oracle WebLogic spawning cmd.exe or
  PowerShell. This is the typical result of successful T3/IIOP deserialization exploitation
  (e.g. CVE-2020-2883 in the Hitachi Energy Service Suite WebLogic component). It
  keys on the parent/child relation, not on any payload string.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \java.exe
    ParentCommandLine|contains: weblogic
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  condition: selection
falsepositives:
- Administrative WLST or deployment scripts that deliberately invoke cmd.exe from
  the WebLogic JVM
- Custom application code on the WebLogic host that shells out to cmd.exe for maintenance
  tasks
level: high
id: 30d22d79-da42-5228-ba11-09afdc2fc6ae
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-05

WebLogic Java Process Spawning Living-off-the-Land Binaries

ATT&CK T1202

WebLogic JVM launching LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, etc.) to download or proxy-execute payloads after a deserialization exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: WebLogic Java Process Spawning Living-off-the-Land Binaries
description: Detects the Oracle WebLogic JVM spawning LOLBins commonly used for indirect
  command execution and payload download after a deserialization RCE (T3/IIOP, CVE-2020-2883).
  Generalises on parent/child relation rather than payload specifics.
tags:
- attack.initial-access
- attack.t1190
- attack.stealth
- attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \java.exe
    ParentCommandLine|contains: weblogic
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \wmic.exe
    - \cscript.exe
    - \wscript.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Rare vendor management tooling on the WebLogic host calling wmic.exe for inventory
level: high
id: 00813a86-56a4-5be9-97d8-53cf650fde00
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-05

WebLogic Java Process Spawning Shell With Download or Reverse Shell Content on Linux

ATT&CK T1190

WebLogic JVM on Linux spawning a shell whose command line contains download, reverse shell or decode primitives. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: WebLogic Java Process Spawning Shell With Download or Reverse Shell Content
  on Linux
description: Detects a Linux java process running Oracle WebLogic spawning sh/bash
  with a command line that downloads content, opens a reverse shell or decodes a payload.
  Typical post-exploitation of T3/IIOP deserialization RCE such as CVE-2020-2883.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentCommandLine|contains: weblogic
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_content:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - base64
    - 'nc '
    - 'ncat '
    - python -c
    - perl -e
  condition: selection_parent and selection_child and selection_content
falsepositives:
- Operations scripts launched from WebLogic that use curl for health checks or callbacks
level: high
id: de384c5b-6041-5f42-a937-0816ad7403bc
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-05

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-05

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs