⚠️ Overview

MarkWatch is a Chinese-language automated web vulnerability scanner and exploitation tool, first identified in 2016 by security researchers monitoring large-scale attack campaigns. It is maintained by an anonymous group known as the "MarkWatch Team," which distributes updates through underground forums and Chinese cloud storage services. The tool is specifically designed for mass reconnaissance and exploitation of internet-facing web applications, with a strong focus on Java-based middleware such as Apache Struts, JBoss, and WebLogic.

🔧 Technical Capabilities

MarkWatch performs comprehensive scanning by sending crafted HTTP requests to identify vulnerable endpoints, testing for SQL injection, remote code execution (RCE), and file inclusion vulnerabilities. It specializes in exploiting known CVEs, most notably CVE-2017-5638 (Apache Struts2 REST plugin RCE) and CVE-2017-12149 (JBoss AS RCE). The bot operates by first gathering server banners and then iterating through a dictionary of attack payloads, including OGNL injections and deserialization exploits. Once a vulnerability is confirmed, MarkWatch can execute arbitrary shell commands, download files from the target, and deploy persistent backdoors. It also includes a brute-force module for administrative panels and weak SSH/FTP credentials. Traffic analysis shows that MarkWatch often uses randomized User-Agent strings but frequently appends a distinctive "MarkWatch" token, and its requests often include unusual headers such as a forged X-Forwarded-For field.

📜 History & Notable Incidents

MarkWatch gained widespread attention during the aftermath of the 2017 Equifax data breach, where it was detected actively scanning for Struts2 vulnerabilities alongside other exploit kits. In 2018, a large-scale campaign dubbed "Operation MarkWatch" was documented by Chinese cybersecurity firm Qi-AnXin, revealing the botnet had compromised over 10,000 web servers across Chinese government and banking sectors. The tool continues to evolve; in 2022, researchers at Trend Micro observed new variants targeting Log4j vulnerabilities (CVE-2021-44228) and unpatched Apache Tomcat deployments. The MarkWatch Team remains active, with source code fragments found on GitHub repositories that have since been taken down by DMCA notices.

🔍 Detection Indicators

The most reliable detection fingerprint is the User-Agent string "Mozilla/5.0 (compatible; MarkWatch/1.0; +http://www.markwatch.com/)" although variations exist, such as "MarkWatch/2.0" or "MarkWatchScanner". Behavioral signatures include rapid sequential scanning of multiple IP addresses on TCP ports 80 and 443, with requests targeting paths like /struts2-showcase/, /jboss-web/, or /weblogic/. Network traffic often shows bursts of over 100 requests per second per source IP, with distinctive payload patterns containing OGNL expressions (e.g., "%{(#nike='multipart/form-data')}") or Java deserialization byte sequences.

☠️ Risk & Impact

Successful exploitation by MarkWatch can lead to full remote control of the targeted web server, enabling attackers to install backdoors, exfiltrate sensitive databases, and use the compromised system as a launchpad for lateral movement within internal networks. The automated nature of the tool allows it to scan thousands of hosts per minute, making it a persistent threat for organizations with unpatched Java middleware. Data exfiltration incidents linked to MarkWatch have resulted in the theft of customer personally identifiable information (PII) and financial records, with recovery costs often exceeding hundreds of thousands of dollars.

🛡️ Mitigation

Immediate blocking upon detection is mandatory because MarkWatch is a confirmed malicious bot that directly exploits known vulnerabilities to gain unauthorized access. Organizations should deploy Web Application Firewall (WAF) rules to block the specific User-Agent strings and request patterns, and ensure all Java middleware is patched against CVEs listed in CISA's catalog. Regular log monitoring for the behavioral indicators described above is essential to identify and contain infections early.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.