The attacker uses Python to automatically exploit the vulnerability to upload webshell, record webshell paths, and further install malicious codes for DDoS attacks and mining on the basis of webshell.

Alibaba Cloud security experts have found that the botnet exploits the Java Debug RCE by downloading mining binary files from malicious download source files to achieve mining.