After achieving initial server access via weak passwords, threat actors proceeded to launch a pair of scripts to retrieve the Hadooken malware, which features not only a cryptocurrency miner but also the Tsunami distributed denial-of-service botnet.
Article Link: Oracle WebLogic servers subjected to novel Hadooken malware attacks | SC Media