Krebs on Security

JULY 23, 2020

According to a filing (PDF) by the New York State Department of Financial Services (DFS), the weakness that exposed the documents was first introduced during an application software update in May 2014 and went undetected for years.

Insurance 299

Insurance Financial Services Mining Access 299

Security Affairs

APRIL 27, 2020

The VictoryGate bot propagates via infected USB devices, it was designed to mine Monero abusing resourced of compromised devices, it is also able to deliver additional payloads. ” continues the analysis. The analysis of the sinkholing activities revealed that there are, on average, 2,000 devices mining throughout the day.

Mining 103

Mining Communications IT Cybersecurity 103

Security Affairs

APRIL 1, 2020

Cybersecurity researchers spotted a crypto-mining botnet, tracked as Vollgar, that has been hijacking MSSQL servers since at least 2018. Researchers at Guardicore Labs discovered a crypto-mining botnet , tracked as Vollgar botnet , that is targeting MSSQL databases since 2018. ” reads the analysis published by Guardicore.

Mining 107

Mining Passwords Education Cybersecurity 107

Security Affairs

FEBRUARY 15, 2019

” reads the analysis published by Symantec. “As soon as the apps are downloaded and launched, they fetch a coin-mining JavaScript library by triggering Google Tag Manager (GTM) in their domain servers. Then the mining script is activated and starts abusing devices resources to mine Monero cryptocurrency.

Mining 89

Mining Libraries Analytics Security 89

Security Affairs

OCTOBER 7, 2020

The analysis of the HEH Bot revealed that it contains three functional modules: propagation module, local HTTP service module and P2P module. ” reads the analysis published by the researchers. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” concludes the post. Pierluigi Paganini.

IoT 120

IoT Mining Communications IT 120

Security Affairs

JUNE 1, 2019

” reads the analysis published by Trend Micro. “The script then calls a Monero coin-mining binary, darwin (detected as PUA.Linux.XMRMiner.AA), to run in the background. As with all cryptocurrency miners, it uses the resources of the host system to mine cryptocurrency (Monero in this instance) without the owner’s knowledge.”

Mining 91

Mining Honeypots Cloud Passwords 91

Security Affairs

APRIL 30, 2020

The campaign primarily targets users in Spain and South American countries, aims to launch a coin-mining shellcode directly in memory. The in-memory DLL then injects a coin-mining code into notepad.exe through process hollowing. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Mining 85

Mining File names Risk Cybersecurity 85

Security Affairs

NOVEMBER 26, 2019

The malicious code abuse of the resources of the infected machine to mine cryptocurrency , according to the experts it has already infected 80,000 computers worldwide. ”reads the analysis published by Microsoft. For example, the MSI package used in the campaign contains different files” continues the analysis.

File names 121

File names Encryption Mining Security 121

Security Affairs

AUGUST 5, 2018

A security researcher discovered a new crypto mining worm dubbed ZombieBoy that leverages several exploits to evade detection. The security researcher James Quinn has spotted a new strain of crypto mining worm dubbed ZombieBoy that appears to be very profitable and leverages several exploits to evade detection. Pierluigi Paganini.

Mining 57

Mining Ransomware Security IT 57

Security Affairs

JANUARY 4, 2019

” reads the analysis published by F-Secure. ” continues the analysis. The service creates multiple threads to carry out several malicious activities, such as data exfiltration and mining. Further information, including IoCs are reported in the analysis published by F.Secure. then it deletes itself.

Mining 85

Mining File names Access IT 85

Security Affairs

JANUARY 31, 2019

” reads the analysis published by PaloAlto Networks. CookieMiner configures the compromised systems to load coinmining software that appears like an XMRIG-type miner, but that mines Koto, a lesser popular cryptocurrency associated with Japan. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Mining 86

Mining Authentication Blockchain Passwords 86

Security Affairs

SEPTEMBER 13, 2019

A new cryptocurrency-mining botnet tracked as WatchBog is heavily using the Pastebin service for command and control (C&C) operations. Cisco Talos researchers discovered a new cryptocurrency -mining botnet tracked as WatchBog is heavily using the Pastebin service for command and control. ” continues Talos. Pierluigi Paganini.

Mining 81

Mining IT Security Information Security 81

Security Affairs

AUGUST 8, 2019

Avast spotted a new strain of Clipsa malware that is used to mine and steal cryptocurrencies along with carrying out brute-force attacks on WordPress sites. Clipsa is a malware that is well known to cyber security community is able to steal cryptocurrency via clipoard hijacking and mine cryptocurrency after installing a miner. .

Mining 87

Mining Passwords IT Security 87

Security Affairs

FEBRUARY 22, 2021

” reads the analysis published by the researchers. ” continues the analysis. BitRAT implements multiple features, including mining cryptocurrencies and RAT features. months, just by selling the APOMacroSploit product.” ” The researchers noticed that the attackers made a mistake, The cutt[.]ly

Cleanup 112

Cleanup Phishing Mining Security 112

Security Affairs

MARCH 13, 2019

. “Recently, 360 Total Security team intercepted a new worm PsMiner written in Go, which uses CVE-2018-1273, CVE-2017-10271, CVE-2015-1427, CVE-2014-3120 and other high-risk vulnerabilities ? ” reads the analysis published by the experts. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Mining 77

Mining Passwords Risk Security 77

Security Affairs

JUNE 22, 2019

Trend Micro recently discovered an Android crypto-currency mining botnet that can spread via open ADB (Android Debug Bridge) ports and Secure Shell (SSH). Security researchers at Trend Micro have discovered an new Android crypto-currency mining botnet that spreads via open ADB ( Android Debug Bridge ) ports and Secure Shell (SSH).

Mining 66

Mining Honeypots Authentication Communications 66

Security Affairs

OCTOBER 28, 2018

Earlier this year Sysdig and Aqua Security researchers started observing cyber attacks targeting Kubernets and Docker instances aimed at mining Monero cryptocurrency. Miscreants can abuse Docker Engine API to deploy containers they have created with the specific intent of mining cryptocurrencies. Pierluigi Paganini.

Mining 84

Mining Systems administration Encryption Authentication 84

Security Affairs

OCTOBER 17, 2019

” reads the analysis published by the experts. Graboid is the first-ever Cryptojacking worm found in images on Docker Hub, the analysis conducted by the experts shows that, on average, each miner is active 63% of the time, with the mining periods being of 250 seconds. ” continues the analysis.

Mining 50

Mining Ransomware Security IT 50

Security Affairs

JANUARY 28, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. “The group is using a new detection evasion tool, copied from open source repositories,” reads the analysis published by AT&T Alien Labs. .

IT 120

IT Libraries Mining Security 120

Security Affairs

JUNE 11, 2020

” Hackers are targeting Kubernetes clusters because nodes used from ML operations have huge computational capabilies making them ideal for fraudulent mining purposes. This fact makes Kubernetes clusters that are used for ML tasks a perfect target for crypto mining campaigns, which was the aim of this attack.”

Mining 84

Mining Access Security IT 84

Security Affairs

APRIL 26, 2019

” reads the analysis published Symantec. ” continues the analysis. ” Experts observed a spike in the activity of Beapy in March: Since Coinhive cryptocurrency mining service shut down in March, experts observed a drop in cryptojacking attacks. “ Beapy ( W32.Beapy Pierluigi Paganini.

Mining 59

Mining Archiving Phishing Passwords 59

Security Affairs

OCTOBER 15, 2019

” reads the analysis published by the security firm Anomaly. “It is expected that the group will continue to exploit more vulnerabilities to mine additional cryptocurrencies in the near future.” ” Technical details, including Indicators of Compromise, are reported in the analysis published by Anomali.

Mining 64

Mining Cloud Security Access 64

Security Affairs

OCTOBER 17, 2019

Researchers at Cyberbit spotted a crypto mining campaign that infected more than 50% of the European airport workstations. . Security experts at Cyberbit have uncovered a crypto mining campaign that infected more than 50% of the European airport workstations. . ” reads the analysis published by Cyberbit. .

Mining 59

Mining Security IT Information Security 59

Security Affairs

JUNE 15, 2019

” reads the analysis published by Trend Micro. ” The AESDDoS malware is active since at least since 2014 and it was used to build large DDoS botnet. launching DDoS attacker, mining cryptocurrency, etc.). ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

File names 92

File names Mining Access Communications 92

Security Affairs

JULY 25, 2019

Experts at Intezer researchers have spotted a strain of the Linux mining that also scans the Internet for Windows RDP servers vulnerable to the Bluekeep. ” continues the analysis. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” reads a blog post published by Intezer. gooobb ” file.

Mining 69

Mining Encryption IT Security 69

Security Affairs

AUGUST 28, 2019

Since it was the C&C server’s responsibility to give mining jobs to the bots, none of the bots received any new mining jobs to execute after this takedown.” “This meant that they could no longer drain the computing power of their victims and that the malware authors no longer received any monetary gain from mining.”

Mining 85

Mining Ransomware IT Security 85

Security Affairs

SEPTEMBER 19, 2019

In February 2018, researchers from Proofpoint discovered a huge botnet dubbed ‘Smominru’ that was using the EternalBlue exploit to infect Windows computers and recruit them in Monero cryptocurrency mining activities. Further data, including Indicators of Compromise, are reported in the analysis published by the experts.

Mining 77

Mining Access IT Security 77

Security Affairs

JUNE 19, 2019

“The analysis showed the malware to have a few quite unpleasant features. ” reads the analysis published by Kaspersky. Post-analysis, the malware was named Backdoor.Win32.Plurox.” Further technical details, including IoCs are reported in the analysis published by Kaspersky. Pierluigi Paganini.

Mining 70

Mining Communications IT Access 70

Security Affairs

FEBRUARY 19, 2019

Technical analysis. Despite its popularity, the Shade payload, at the analysis time, did not show high detection rates: only a third of antimalware detected it (24/69), even if the behaviour of the threat is such harassing as recognizable. However, the mining pool dashboard provides a clue of the current number of infected machines.

Ransomware 76

Ransomware Mining File names Encryption 76

Security Affairs

FEBRUARY 27, 2019

Cisco Talos experts have reported a spike in the attacks that leverage known flaws to compromise unsecured Elasticsearch clusters and use them to mine crypto-currencies. and lower) to compromise them and install the malicious code the exploit the CVE-2014-3120 and CVE-2015-1427 vulnerabilities. Pierluigi Paganini.

Search queries 83

Search queries Honeypots File names Mining 83

Security Affairs

JUNE 5, 2019

The list of exploits used by the malware includes EternalBlue , DoublePulsar ; exploits for CVE-2014-6287, Tomcat arbitrary file upload vulnerability CVE-2017-12615 , CVE-2017-8464 ; and three ThinkPHP exploits for different versions of the framework. continues the analysis. The last week of May is the most active period on record. .

Mining 63

Mining File names Libraries IT 63

Security Affairs

SEPTEMBER 29, 2018

” reads the analysis published by Avast. “Unlike the aforementioned IoT botnets, this one tries to be more stealthy and persistent once the device is compromised, and it does not (yet) do the usual stuff a botnet does like DDOS , attacking all the devices connected to the internet, or, of course, mining cryptocurrencies.”

IoT 84

IoT Communications Mining Encryption 84

Security Affairs

NOVEMBER 26, 2018

” Reads the analysis published by Dr. Web. downloads and starts its own Monero-mining operation. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Then the Linux.BtcMine.174. Linux.BtcMine.174 Pierluigi Paganini.

Mining 83

Mining Passwords Security IT 83

Security Affairs

SEPTEMBER 26, 2018

” reads the analysis published by BitDefender. ” In February 2018, security researchers at Qihoo 360’s Netlab have spotted an Android mining botnet that was targeting devices with ADB interface open. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

IoT 99

IoT Mining Access Security 99

Security Affairs

AUGUST 31, 2019

” reads the analysis published by the experts. In June, Trend Micro discovered an Android crypto-currency mining botnet that can spread via open ADB (Android Debug Bridge) ports and Secure Shell (SSH). . ” continues the analysis. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

IoT 80

IoT Passwords Mining Manufacturing 80

Security Affairs

AUGUST 3, 2018

Experts uncovered a massive cryptojacking campaign that is targeting MikroTik routers to inject a Coinhive cryptocurrency mining script in the web traffic. ” continues the analysis. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Mining 68

Mining Libraries Security IT 68

Security Affairs

JULY 28, 2018

The attackers compromised a font package installed by a PDF editor app and used it to spread a crypto-mining malware on victims’ machines. ” reads the analysis published by Microsoft. The attackers decompiled and modified one MSI file, an Asian fonts pack, to add the malicious payload with the coin mining code.

Mining 49

Mining Cloud Communications Marketing 49