Security Affairs

FEBRUARY 18, 2021

PaloAlto Network warns of the WatchDog botnet that uses exploits to take over Windows and Linux servers and mine cryptocurrency. Security researchers at Palo Alto Networks uncovered a cryptojacking botnet, tracked as WatchDog, that is targeting Windows and Linux systems. The WatchDog botnet has been active at least since Jan.

Mining 139

Mining Cloud Access Security 139

Security Affairs

APRIL 28, 2024

It’s a PPSX file, seemingly an outdated US Army manual for tank mine clearing blades (MCB). The DLL also implements features to evade detection and avoid analysis by security experts. The file, although labeled as shared through the Signal app, might not have been originally sent via the application.

Military 109

Military Mining Libraries Security 109

Security Affairs

DECEMBER 12, 2022

Researchers spotted a cryptocurrency mining campaign targeting Linux users with Go-based CHAOS malware (Trojan.Linux.CHAOSRAT). In November 2022, Trend Micro researchers discovered a cryptocurrency mining campaign targeting Linux users with Go-based CHAOS malware (Trojan.Linux.CHAOSRAT). Gather operating system information.

Mining 99

Mining Cloud Security IT 99

Security Affairs

JULY 24, 2018

” The Trend Micro researchers’ analysis shows a fairly typical command & control (C&C) malware infection process with many similarities to the Satori variant of the Mirai botnet. Analysis of the code indicates that it could be used as a distributed denial of service (DDoS) platform if enough devices are compromised.

Mining 45

Mining IoT Blockchain Risk 45

Security Affairs

MAY 3, 2024

This second botnet exhibits greater discretion and improved operational security, as the associated malware operates exclusively in memory, leaving no malicious files on the disk. The analysis of memory dumps and command-and-control connections revealed that the botnet is running a variant of the Ngioweb malware.

Healthcare 93

Healthcare Phishing e-Discovery Mining 93

Security Affairs

FEBRUARY 21, 2024

A new malware campaign targets Redis servers to deploy the mining crypto miner Migo on compromised Linux hosts. Caro Security researchers have observed a new malware campaign targeting Redis servers with a crypto miner dubbed Migo. The attackers continue to improve their capability to exploit web-facing services.

Mining 103

Mining Honeypots Cloud Ransomware 103

Security Affairs

MAY 26, 2021

” reads the analysis published by Trend Micro. The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. The malware deploys the XMRig mining tool to mine Monero cryptocurrency. ” reads the analysis published by Trend Micro.

Mining 130

Mining Cloud Security Access 130

Krebs on Security

MARCH 7, 2022

In 2020, researchers from Athens University School of Information Sciences and Technology in Greece showed (PDF) how ransomware-as-a-service offerings might one day be executed through smart contracts. Before that, Jeffrey Ladish , an information security consultant based in Oakland, Calif., We start ddosing. We release ddos.

Ransomware 214

Ransomware Mining Blockchain Sales 214

Security Affairs

MARCH 30, 2021

The expert determined the number of cryptocurrencies that were mined to a mining pool account by inspecting the mining pool. Half of the images discovered by the expert were using a shared mining pool, by he estimated that threat actors mined US$200,000 worth of cryptocurrencies in a two-year period.

Mining 101

Mining Libraries Cloud Security 101

Security Affairs

APRIL 22, 2022

The Lemon_Duck cryptomining botnet is targeting Docker servers to mine cryptocurrency on Linux systems. Crowdstrikes researchers reported that the Lemon_Duck cryptomining botnet is targeting Docker to mine cryptocurrency on Linux systems. ” reads the analysis published by CrowdStrikes. ” concludes the report.

Mining 84

Mining Cloud Access Cybersecurity 84

Security Affairs

JANUARY 10, 2022

Experts linked the C2 infrastructure behind an the Abcbot botnet to a cryptocurrency-mining botnet attack that was uncovered in December 2020. Experts linked the infrastructure used by the Abcbot DDoS botnet to the operations of a cryptocurrency-mining botnet that was uncovered in December 2020.

Mining 85

Mining Honeypots Cloud Security 85

Security Affairs

NOVEMBER 14, 2022

Akamai Security Research discovered a new evasive Golang-based malware, tracked as KmsdBot, that infects systems via an SSH connection that uses weak login credentials. The malware was employed in cryptocurrency mining campaigns and to launch denial-of-service (DDoS) attacks. ” reads the post published by Akamai.

Mining 90

Mining Manufacturing Authentication Security 90

Security Affairs

OCTOBER 30, 2023

Further analysis revealed that the malware has been used since at least 2017. ” reads the analysis published by Kaspersky. Researchers from Kaspersky discovered a sophisticated malware, dubbed StripedFly, that remained under the radar for five years masquerading as a cryptocurrency miner. “What was the real purpose?

Ransomware 117

Ransomware Mining Communications IT 117

Security Affairs

DECEMBER 13, 2021

” reads the analysis published by Microsoft. Please see the Information Leaks section for more information.” ” Talos researchers also updated the list of IOCs to include information about mining activity carried out by exploiting the CVE-2021-44228 flaw. Pierluigi Paganini.

Mining 117

Mining Honeypots Libraries IT 117

Security Affairs

DECEMBER 25, 2021

” reads the analysis published by ReasonLabs. The resource contains information for the mining activity, the researchers identified a self-compiled version of the XMrig open-source miner containing information such as username, password, algorithm, and mining pool. mp4” format.

Mining 83

Mining Passwords IT Security 83

Security Affairs

OCTOBER 23, 2021

CISA warned of crypto-mining malware hidden in a popular JavaScript NPM library, named UAParser.js, which has millions of weekly downloads. Cybersecurity and Infrastructure Security Agency published an advisory to warn of the discovery of a crypto-mining malware in the popular NPM Package UAParser.js.

Mining 132

Mining Libraries Cybersecurity Security 132

Security Affairs

FEBRUARY 24, 2023

” reads the analysis published by the experts. At the time of its discovery, the sample analyzed by the experts was not labeled as malicious by any security vendors on VirusTotal. The malicious code uses i2p to download malicious components and send mined currency to the attacker’s wallet. We now had our answer.”

Mining 89

Mining Passwords Communications Security 89

Security Affairs

JANUARY 25, 2021

. “These particular applications are targeted because they often run on systems that have powerful underlying hardware with significant amounts of memory and powerful CPUs—all of which allow threat actors to maximize their ability to monetize these resources through mining cryptocurrency.” ” continues the analysis.

Mining 139

Mining Passwords Communications Ransomware 139

Security Affairs

SEPTEMBER 29, 2022

” reads the analysis published by Lumen Technologies. The analysis of the infections from mid-June to mid-July 2022 revealed that most of the bots are located in Europe, specifically Italy. ” continues the report. . ” continues the report. Other infections were observed in North and South America and Asia Pacific.

Mining 84

Mining Financial Services IT Security 84

Security Affairs

JANUARY 4, 2023

The ASEC analysis team recently discovered that a Linux malware developed with shell script compiler ( shc ) that threat actors used to install a CoinMiner. The compressed file contains the XMRig CoinMiner malware along with a config.json with the mining pool URL and the “run” script. ” reads the report published by ASEC.

Mining 93

Mining Passwords Access Security 93

Security Affairs

MARCH 11, 2023

The crypto-mining botnet has a modular structure and employs multiple techniques to infect systems and evade detection. “More specifically, the botnet operators updated certain submodules of the execution chain to automate processes and challenge forensic analysis methods.” ” reads the post published by Cisco Talos.

Mining 97

Mining Communications Security IT 97

Security Affairs

DECEMBER 21, 2021

The bot also kills competing malware, including crypto mining and cloud-focused malware, on the same systems. ” reads the analysis published by the experts. ” concludes the analysis. ” concludes the analysis. “However, the code used to download the third payload appears to be commented-out.”

Cloud 127

Cloud Mining Access Security 127

Security Affairs

JUNE 15, 2022

” The botnet is engaged in cryptomining activity, the malicious code has been designed to hijack the computer’s resources to mine cryptocurrencies. ” reads the analysis published by the experts. At the time of the analysis, the researchers discovered 209 peers, 40 of which are currently active. .

Mining 89

Mining Education Authentication Security 89

Security Affairs

JUNE 22, 2021

The Windows botnet has been active since late 2017, it was mainly used to mine cryptocurrency, but it was also involved in DDoS attacks in 2018. “Recently, a new infection vector that cracks Windows machines through SMB password brute force is on the rise” reads the analysis published by AVAST. ” continues the report.

Mining 126

Mining Passwords Communications IT 126

Security Affairs

APRIL 15, 2022

The crimeware allows operators to steal information from infected systems and abuse its resources to mine Monero. The malicious code is able to harvest system metadata and information stored by popular web browsers, including Google Chrome, Mozilla Firefox, Opera, and Opera GX.

Mining 83

Mining Metadata Cybersecurity IT 83

Security Affairs

SEPTEMBER 9, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. Experts pointed out that even if the group is expanding its arsenal adding new capabilities, it still focuses on cryptocurrency mining. ” reads the analysis published by AT&T.

Mining 90

Mining IT Cloud Security 90

Security Affairs

AUGUST 29, 2022

” reads the analysis published by Check Point. Once the malicious code is executed, the malware connects to the C2 server to get the XMRig crypto miner configuration and starts mining crypto currencies.

Mining 93

Mining Security Information Security IT 93

Security Affairs

OCTOBER 13, 2021

” reads the analysis published by the expert. ” The malware was first spotted in February 2018 by researchers from Proofpoint when the bot was using the EternalBlue exploit to infect Windows computers and recruit them in Monero cryptocurrency mining activities. .” ” continues the analysis.

ROT 99

ROT Mining Encryption IT 99

Security Affairs

NOVEMBER 4, 2023

” reads the analysis published by Aqua firm. Kinsing actors often exploited the PHPUnit vulnerability ( CVE-2017-9841 ) and it engaged in fully automated attacks as part of mining cryptocurrency. ” continues the analysis. The experts pointed out that this marks the first documented instance of such an exploit.

Cloud 96

Cloud Mining Access Security 96

Security Affairs

SEPTEMBER 17, 2021

Upon infecting a system, the malware abuses its resources to mine cryptocurrency. . “Around the same time the news was spreading about these crypto mining malware attacks, SIRT honeypots were infected with PHP malware that arrived via a backdoored addition to a WordPress plugin named download-monitor.” Pierluigi Paganini.

Honeypots 86

Honeypots Mining Encryption Access 86

Security Affairs

APRIL 24, 2024

” reads the analysis published by Avast. Puppeteer orchestrates the core functionality of the malware, including the cryptocurrency mining as well as the backdoor deployment. “The main objective of GuptiMiner is to distribute backdoors within big corporate networks.”

Cleanup 97

Cleanup Mining Encryption IT 97

Security Affairs

MARCH 20, 2024

The two flaws were discovered by Stephen Fewer, Principal Security Researcher at Rapid7, were disclosed following Rapid7’s vulnerability disclosure policy. Rapid7 published a detailed analysis of the two flaws here.

Authentication 115

Authentication Ransomware Mining Risk 115

Security Affairs

JUNE 3, 2022

The bot focuses on cryptocurrency mining and cryptocurrency theft via clipboard hijacking. ” reads the analysis published by Symantec. Researchers at Symantec’s Threat Hunter Team uncovered a cryptomining operation that has potentially made the actors behind it at least $1.7 million in illicit gains. Bitcoin and 129.9

Mining 136

Mining Archiving Cybersecurity Security 136

Security Affairs

NOVEMBER 7, 2020

” reads the analysis published by the expert. 30th) attempting to install crypto-mining tools.” ” The expert spotted a small number of scans starting on October 30 attempting to install crypto-mining tools. .” Pierluigi Paganini. SecurityAffairs – hacking, CVE-2020-14882).

Ransomware 88

Ransomware Honeypots Mining Security 88

Security Affairs

AUGUST 8, 2022

While the first two variants exclusively rely on date strings to generate the domain names, the newer version uses balance information obtained from the cryptocurrency wallet address “ 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa.” ” reads the analysis published by the researchers.

Mining 95

Mining IT Security Information Security 95

Security Affairs

NOVEMBER 22, 2023

reads the analysis published by Aqua firm. Kinsing actors often exploited the PHPUnit vulnerability ( CVE-2017-9841 ) and it engaged in fully automated attacks as part of mining cryptocurrency. The experts pointed out that this marks the first documented instance of such an exploit.

IT 94

IT Mining Cloud Cybersecurity 94

Security Affairs

JANUARY 21, 2021

QNAP is warning customers of a new piece of malware dubbed Dovecat that is targeting NAS devices to mine cryptocurrency. Taiwanese vendor QNAP has published a security advisory to warn customers of a new piece of malware named Dovecat that is targeting NAS devices. ” reads the security advisory published by the vendor.

Mining 113

Mining Passwords Ransomware Security 113