This week’s threat landscape is a stark reminder that attackers do not need zero-days to cause outsized damage. A critical remote code execution (RCE) vulnerability in Apache OFBiz is putting enterprise resource planning (ERP) environments at immediate risk. Simultaneously, DreamHost has disclosed a security breach that could expose customer credentials and infrastructure, and a wave of DeFi site hijacks is demonstrating how stolen logins and trusted settings can be weaponized to lock out legitimate users and drain assets.
The common thread? Attackers are leveraging small cracks—unpatched systems, reused credentials, and misconfigured trust settings—to pivot across environments. In many cases, organizations are taking months, sometimes over a year, to remediate known vulnerabilities. That gap is exactly where adversaries operate. If you run Apache OFBiz, manage hosting infrastructure, or protect financial platforms, this is not a drill. You need to assess exposure, hunt for compromise, and apply mitigations immediately.
Technical Analysis
Apache OFBiz Critical Code Execution Flaw
Apache OFBiz is an open-source ERP framework used by enterprises for accounting, inventory, e-commerce, and supply-chain management. The newly disclosed critical RCE flaw allows unauthenticated attackers to execute arbitrary code on vulnerable OFBiz instances. While specific CVE identifiers and CVSS scores have not been released in the source material, the vulnerability is described as critical and exploitable remotely without authentication.
From a defender’s perspective, the attack chain typically involves:
- Remote code execution via crafted HTTP requests to OFBiz web endpoints
- Deserialization or template injection leading to arbitrary Java code execution
- Post-exploitation: web shell deployment, credential harvesting, lateral movement into ERP databases and connected systems
OFBiz runs as a Java application (commonly on Apache Tomcat). Exploitation will generate anomalous process execution under the Java/Tomcat service account, unusual outbound connections from the ERP server, and unexpected file writes in web-accessible directories.
DreamHost Breach
DreamHost, a major web hosting and domain registrar, has confirmed a security breach. While the full scope is still emerging, breaches at hosting providers are particularly dangerous because they can expose:
- Customer account credentials (which are often reused across services)
- Hosted website configurations, databases, and SSL/TLS keys
- Domain management access, enabling DNS hijacking and phishing infrastructure
The immediate risk is credential stuffing, account takeover, and supply-chain compromise of downstream sites. If your organization uses DreamHost for any service, assume credentials may be exposed and hunt for unauthorized access.
DeFi Site Hijacks
Decentralized finance (DeFi) platforms are being hijacked through a combination of stolen credentials, abused trust settings, and infrastructure compromise. Attackers are not breaking cryptography—they are simply logging in with valid credentials, changing DNS or CDN settings, and redirecting users to malicious frontends that drain wallets.
This is a classic trusted relationship abuse scenario. The attack succeeds because:
- DNS or hosting account credentials are stolen or phished
- Multi-factor authentication (MFA) is absent or bypassed
- No out-of-band verification exists for critical configuration changes
Once attackers control the site frontend or DNS, they can inject malicious JavaScript to intercept wallet connections and approvals, stealing funds directly from users.
Detection & Response
SIGMA Rules
The following Sigma rules target the specific post-exploitation behaviors described: anomalous process execution from Java/Tomcat (OFBiz), suspicious web server child processes, and unexpected outbound connections from ERP/web servers.
---
title: Apache OFBiz Java Process Spawning Shell or Script Interpreter
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects Apache OFBiz or Tomcat Java processes spawning command shells or script interpreters, indicative of RCE exploitation and web shell deployment.
references:
- https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/05
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\java.exe'
- '\javaw.exe'
- '\tomcat.exe'
- '\catalina.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts executed by OFBiz administrators
- Monitoring or backup tools running under the Tomcat service account
level: high
---
title: Linux Apache OFBiz Tomcat Spawning Shell
id: 9c2e4a71-5f8b-4d3a-b6c1-8e7f2a1d3b5c
status: experimental
description: Detects Apache OFBiz or Tomcat processes on Linux spawning shells or script interpreters, indicative of RCE exploitation.
references:
- https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html
- https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/11/05
tags:
- attack.execution
- attack.t1059.004
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/java'
- '/catalina.sh'
- '/tomcat'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/python'
- '/perl'
- '/curl'
- '/wget'
condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative or deployment scripts
- Health checks and monitoring agents
level: high
---
title: Web Server Suspicious Outbound Connection to Rare External IP
id: 4d8f2e6a-1b3c-4e5f-9a7d-2c8e6f1a4b9d
status: experimental
description: Detects web servers (Java/Tomcat/Apache/Nginx) making outbound connections to rare or suspicious external IPs, indicative of post-exploitation C2 or data exfiltration following OFBiz or web app compromise.
references:
- https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html
- https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/11/05
tags:
- attack.command_and_control
- attack.t1071
- attack.exfiltration
logsource:
category: network_connection
product: linux
detection:
selection_process:
Image|endswith:
- '/java'
- '/httpd'
- '/nginx'
- '/apache2'
- '/tomcat'
selection_network:
DestinationIp|cidr:
- '0.0.0.0/0'
DestinationIp|contains:
- '10.'
- '172.16.'
- '192.168.'
filter_rfc1918:
DestinationIp|cidr:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '127.0.0.0/8'
condition: selection_process and selection_network and not filter_rfc1918
falsepositives:
- Legitimate outbound API calls or database connections
- Software update checks
level: medium
KQL (Microsoft Sentinel / Defender)
This KQL hunts for suspicious process execution from Java/Tomcat processes across both Windows and Linux endpoints ingested into Sentinel via Defender for Endpoint and Syslog.
// Hunt for Apache OFBiz / Tomcat spawning suspicious child processes
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "/bin/sh", "/bin/bash", "/usr/bin/python", "/usr/bin/curl", "/usr/bin/wget"]);
let javaProcesses = dynamic(["java.exe", "javaw.exe", "tomcat.exe", "catalina.exe", "/java", "/tomcat", "catalina.sh"]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (javaProcesses)
| where FileName has_any (suspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SHA256
| extend Source = "Defender"),
(Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any (javaProcesses)
| where SyslogMessage has_any (suspiciousChildren)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| extend Source = "Syslog")
| order by TimeGenerated desc
Velociraptor VQL
This VQL artifact hunts for suspicious child processes spawned by Java/Tomcat and checks for recently written web shell files in common OFBiz deployment directories.
-- Hunt for Apache OFBiz RCE post-exploitation: suspicious child processes and web shell artifacts
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime, Ppid
FROM pslist()
WHERE (Exe =~ '(?i)(java|tomcat|catalina)' OR Name =~ '(?i)(java|tomcat|catalina)')
AND (
CommandLine =~ '(?i)(cmd\.exe|powershell|pwsh|wscript|cscript|mshta|rundll32|/bin/sh|/bin/bash|python|curl|wget)'
OR Exe =~ '(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|/bin/sh|/bin/bash)'
)
-- Hunt for recently modified JSP/web shell files in OFBiz web directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='**/webapp/**/*.jsp', accessor='file')
WHERE Mtime > now() - 604800
AND (
FullPath =~ '(?i)(ofbiz|tomcat|webapps)'
OR FullPath =~ '(?i)(shell|cmd|exec|backdoor|webshell)'
)
ORDER BY Mtime DESC
Remediation Script (Bash)
This Bash script checks for vulnerable OFBiz installations, verifies running processes, inspects recent web directory modifications, and checks for suspicious outbound connections. Run it on Linux OFBiz/Tomcat servers.
#!/bin/bash
# Apache OFBiz RCE Detection and Hardening Script
# Run as root or with sudo
echo "=== Apache OFBiz Security Check ==="
echo ""
# 1. Check if OFBiz/Tomcat is running
echo "[*] Checking for running OFBiz/Tomcat processes..."
ps aux | grep -iE '(ofbiz|tomcat|catalina)' | grep -v grep
if [ $? -ne 0 ]; then
echo "[-] No OFBiz/Tomcat processes detected."
else
echo "[!] OFBiz/Tomcat is running. Verify version and patch status immediately."
fi
echo ""
# 2. Check OFBiz version (if accessible)
echo "[*] Checking OFBiz version..."
if [ -d "/opt/ofbiz" ]; then
grep -r "version" /opt/ofbiz/framework/base/config/*.properties 2>/dev/null | head -5
elif [ -d "/usr/share/ofbiz" ]; then
grep -r "version" /usr/share/ofbiz/framework/base/config/*.properties 2>/dev/null | head -5
else
echo "[-] OFBiz directory not found in standard locations."
fi
echo ""
# 3. Check for recently modified JSP files in web directories
echo "[*] Checking for recently modified JSP files (potential web shells)..."
find /opt/ofbiz /usr/share/ofbiz /var/lib/tomcat* /opt/tomcat* -name "*.jsp" -mtime -7 2>/dev/null | head -20
if [ $? -eq 0 ]; then
echo "[!] Review the above JSP files for unauthorized modifications."
fi
echo ""
# 4. Check for suspicious outbound connections from Java/Tomcat
echo "[*] Checking for suspicious outbound connections from Java processes..."
netstat -tunp 2>/dev/null | grep -iE 'java|tomcat' | grep ESTABLISHED | grep -vE '127.0.0.1|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.'
if [ $? -eq 0 ]; then
echo "[!] External connections detected. Investigate destination IPs."
fi
echo ""
# 5. Check for suspicious child processes
echo "[*] Checking for shells spawned by Java/Tomcat..."
ps auxf | grep -iE 'java|tomcat' | grep -iE '(sh|bash|python|curl|wget)' | grep -v grep
if [ $? -eq 0 ]; then
echo "[!] Suspicious child processes detected. Investigate immediately."
fi
echo ""
# 6. Recommendations
echo "=== Recommendations ==="
echo "1. Apply the latest Apache OFBiz security patches immediately."
echo "2. If patching is not possible, isolate OFBiz servers from the internet."
echo "3. Restrict outbound connections from OFBiz servers to only required destinations."
echo "4. Enable detailed logging for all OFBiz/Tomcat access and error logs."
echo "5. Rotate all credentials that may have been accessible from OFBiz servers."
echo "6. Review DreamHost breach notification and reset any credentials used there."
echo "7. Enforce MFA on all hosting, DNS, and administrative accounts."
echo ""
echo "Run this script weekly and after any security updates."
Remediation
Apache OFBiz
Immediate actions:
- Patch immediately. Check the Apache OFBiz security advisories and apply the latest security update for your version. If a patch is not yet available, isolate OFBiz servers from direct internet exposure.
- Restrict network access. Place OFBiz behind a reverse proxy or VPN. Block direct internet access to OFBiz admin and web service ports.
- Enable egress filtering. OFBiz servers should not initiate outbound connections to arbitrary internet IPs. Allow only required endpoints (e.g., package repositories, NTP, DNS).
- Rotate credentials. Assume any credentials stored in or accessible from OFBiz (database passwords, API keys, service accounts) are compromised. Rotate them now.
- Hunt for compromise. Review OFBiz logs for suspicious POST requests, template injection attempts, or deserialization errors. Check for new JSP files, unexpected processes, and outbound connections.
DreamHost Breach
- Reset all credentials. If your organization uses DreamHost, reset passwords for all accounts, especially those with administrative or billing access.
- Enforce MFA. Enable multi-factor authentication on DreamHost accounts and any service that uses DreamHost-hosted infrastructure.
- Review DNS and domain settings. Verify that no unauthorized changes were made to DNS records, nameservers, or domain forwarding rules.
- Audit hosted content. Check for unauthorized file uploads, modified web pages, or injected scripts on DreamHost-hosted sites.
- Monitor for credential stuffing. Watch for login attempts using DreamHost credentials across your environment, especially from unusual geographies or IPs.
DeFi Site Hijacks
- Enforce MFA everywhere. All administrative, hosting, DNS, and CDN accounts must have MFA enabled. Prefer hardware tokens (FIDO2) over SMS or TOTP.
- Implement out-of-band verification. Require multi-person approval and out-of-band confirmation (e.g., phone call to a known number) for DNS changes, domain transfers, and CDN configuration updates.
- Monitor DNS and certificate transparency. Use services like Certificate Transparency logs and DNS monitoring to detect unauthorized changes to your domains.
- Deploy Subresource Integrity (SRI). For critical JavaScript and CSS, use SRI hashes to prevent injection of malicious third-party scripts.
- Educate users. Warn users about phishing and fake DeFi frontends. Encourage them to verify URLs and use bookmarked links rather than search results.
General Hardening
- Reduce patch latency. If your organization takes months to patch critical vulnerabilities, you are operating at unacceptable risk. Implement a 72-hour SLA for critical RCE patches on internet-facing systems.
- Segment ERP and financial systems. OFBiz and similar ERP platforms should be in isolated network segments with strict access controls.
- Deploy EDR and network monitoring. Endpoint detection and response (EDR) plus network traffic analysis (NTA) will catch post-exploitation behaviors that signature-based tools miss.
- Assume breach. Given the speed of modern attacks, assume that perimeter defenses will fail. Build detection and response capabilities to catch attackers before they achieve their objectives.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.