Security Affairs

AUGUST 18, 2020

Security firm Cado Security reported that the TeamTNT botnet is the first one that is able to scan and steal AWS credentials. The TeamTNT botnet is a crypto-mining malware operation that has been active since April and that targets Docker installs. It’s the first worm we’ve seen that contains such AWS specific functionality.

Mining 108

Mining Security Access IT 108

Security Affairs

JULY 29, 2020

The ongoing Ngrok mining botnet campaign is targeting servers are hosted on popular cloud platforms, including Alibaba Cloud, Azure, and AWS. “ Ngrok Mining Botnet is an active campaign targeting exposed Docker servers in AWS, Azure, and other cloud platforms. .” ” continues the report. Pierluigi Paganini.

Blockchain 141

Blockchain Mining Cloud Communications 141

Security Affairs

OCTOBER 26, 2020

The primary purpose of the KashmirBlack botnet is to abuse resources of compromised systems for cryptocurrency mining and redirecting a site’s legitimate traffic to spam pages. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

CMS 115

CMS Mining Communications Security 115

Security Affairs

SEPTEMBER 13, 2019

A new cryptocurrency-mining botnet tracked as WatchBog is heavily using the Pastebin service for command and control (C&C) operations. Cisco Talos researchers discovered a new cryptocurrency -mining botnet tracked as WatchBog is heavily using the Pastebin service for command and control. ” continues Talos. Pierluigi Paganini.

Mining 83

Mining IT Security Information Security 83

Security Affairs

AUGUST 8, 2019

Avast spotted a new strain of Clipsa malware that is used to mine and steal cryptocurrencies along with carrying out brute-force attacks on WordPress sites. Clipsa is a malware that is well known to cyber security community is able to steal cryptocurrency via clipoard hijacking and mine cryptocurrency after installing a miner. .

Mining 91

Mining Passwords IT Security 91

Security Affairs

OCTOBER 23, 2020

A few days before, EVRAZ , one of the world’s largest multinational vertically integrated steel making and mining companies, has been hit by the Ryuk ransomware. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Ransomware 109

Ransomware Computer and Electronics Mining Manufacturing 109

Security Affairs

MARCH 8, 2020

A few days ago EVRAZ , one of the world’s largest multinational vertically integrated steel making and mining companies, has been hit by the Ryuk ransomware. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Ransomware 119

Ransomware IT Computer and Electronics Mining 119

Security Affairs

OCTOBER 17, 2019

Researchers at Cyberbit spotted a crypto mining campaign that infected more than 50% of the European airport workstations. . Security experts at Cyberbit have uncovered a crypto mining campaign that infected more than 50% of the European airport workstations. . ” reads the analysis published by Cyberbit. .

Mining 63

Mining Security IT Information Security 63

Security Affairs

OCTOBER 7, 2020

Experts pointed out that the bot doesn’t contain any offensive features, such as the ability to launch DDoS attacks or to mine cryptocurrency, a circumstance that suggests the malware is under development. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” concludes the post. Pierluigi Paganini.

IoT 121

IoT Mining Communications IT 121

Security Affairs

AUGUST 28, 2019

Most of the infected systems were located in Latin America, more than 85% of victims did not have any security software installed. The Retadup bot has been around since at least 2015, it was involved in several malicious campaigns aimed at delivering malware such as information stealers, ransomware and miners.

Mining 87

Mining Ransomware IT Security 87

Security Affairs

AUGUST 20, 2019

The backdoor was used by attackers to inject mining code in Ruby projects using the malicious versions of the libraries. RubyGems maintainers discovered that the backdoor mechanism was used by threat actors to insert cryto -mining code in the projects using the malicious versions of the libraries. Pierluigi Paganini. SecurityAffairs –.

Libraries 92

Libraries Mining Passwords Authentication 92

Security Affairs

OCTOBER 28, 2020

A few days before, EVRAZ , one of the world’s largest multinational vertically integrated steel making and mining companies, has been hit by the Ryuk ransomware. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. In March, the City of Durham shut down its network after Ryuk Ransomware attack.

Ransomware 104

Ransomware Computer and Electronics Manufacturing Mining 104

Security Affairs

JULY 25, 2019

Experts at Intezer researchers have spotted a strain of the Linux mining that also scans the Internet for Windows RDP servers vulnerable to the Bluekeep. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” reads a blog post published by Intezer. ” reads a blog post published by Intezer.

Mining 71

Mining Encryption IT Security 71

Security Affairs

JUNE 4, 2021

The Necro Python bot, aka FreakOut, has been in development since 2015 and early this year researchers from Check Point and Netlab 360 have provided details about its activity. Experts from Cisco Talos have recently observed a new Necro Python bot campaign and noticed that its developers have improved its capabilities.

Mining 115

Mining Passwords IoT Security 115

Security Affairs

JUNE 22, 2019

Trend Micro recently discovered an Android crypto-currency mining botnet that can spread via open ADB (Android Debug Bridge) ports and Secure Shell (SSH). Security researchers at Trend Micro have discovered an new Android crypto-currency mining botnet that spreads via open ADB ( Android Debug Bridge ) ports and Secure Shell (SSH).

Mining 67

Mining Honeypots Authentication Communications 67

Security Affairs

AUGUST 29, 2019

According to the indictment, Paige THOMPSON created a scanning software that used to identify AWS customers who had misconfigured their firewalls, then the hacker accessed their servers to steal data, and to “mine” cryptocurrency. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Last week, a U.S.

Mining 81

Mining Cloud Data breaches Access 81

Security Affairs

SEPTEMBER 19, 2019

In February 2018, researchers from Proofpoint discovered a huge botnet dubbed ‘Smominru’ that was using the EternalBlue exploit to infect Windows computers and recruit them in Monero cryptocurrency mining activities. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Mining 78

Mining Access IT Security 78

Security Affairs

MAY 4, 2020

. “Around 1:30AM UTC on May 3rd, 2020 an attacker used a CVE in our saltstack master to gain access to our infrastructure (please see [link] for more information). Administrators should install the available security updates to protect their installs. This affects both Ghost(Pro) sites and Ghost.org billing services.”

Mining 116

Mining Authentication Ransomware Access 116

Security Affairs

OCTOBER 18, 2020

The police also seized an extensive bitcoin mining operation in Bulgaria associated with QQAAZZ. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. The police executed more than 40 house searches in Latvia, Bulgaria, the United Kingdom, Spain, and Italy. Pierluigi Paganini.

Mining 112

Mining IT Security Information Security 112

Security Affairs

FEBRUARY 2, 2020

. “This email service was used by cybercriminals both in 2019 and especially actively in January 2020 to send false messages under the guise of reliable information about mass mining of objects in the Russian Federation,” . Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Government 97

Government Mining Encryption Access 97

Security Affairs

NOVEMBER 26, 2019

Security experts at Microsoft analyzed a new strain of cryptocurrency miner tracked as Dexphot that has been active since at least October 2018. The malicious code abuse of the resources of the infected machine to mine cryptocurrency , according to the experts it has already infected 80,000 computers worldwide. Pierluigi Paganini.

File names 126

File names Encryption Mining Security 126

Security Affairs

SEPTEMBER 12, 2020

“This could be through a loss of mining time or expenditure of electricity by shutting down nodes and delaying blocks or causing the network to temporarily partition.” ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” continues the paper. “Not as far as we know.”

Blockchain 105

Blockchain Paper Mining IT 105

Security Affairs

OCTOBER 15, 2019

. “It is expected that the group will continue to exploit more vulnerabilities to mine additional cryptocurrencies in the near future.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. SecurityAffairs – Rocke cybercrime gang, mine r ). Pierluigi Paganini.

Mining 64

Mining Cloud Security Access 64

Security Affairs

JUNE 5, 2019

“Simultaneous with its attacks, BlackSquid also downloads and executes two XMRig cryptocurrency-mining components.! The malware implements anti-virtualization, anti-debugging, and anti-sandboxing methods to determine whether to deliver the miner or not. continues the analysis. The last week of May is the most active period on record.

Mining 63

Mining File names Libraries IT 63

Security Affairs

OCTOBER 17, 2019

Graboid is the first-ever Cryptojacking worm found in images on Docker Hub, the analysis conducted by the experts shows that, on average, each miner is active 63% of the time, with the mining periods being of 250 seconds. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Mining 54

Mining Ransomware Security IT 54

Security Affairs

JUNE 9, 2020

The company manufactures a variety of heavy equipment (bulldozers, dump trucks, hydraulic excavators, wheel loaders, rope shovels, walking draglines, motor graders and scrapers), such as that used for earthmoving, transport and mining. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Data breaches 72

Data breaches Mining Passwords Marketing 72

Security Affairs

SEPTEMBER 2, 2019

“I suspect it’s probably a derivate of other IoT crypto mining botnets,” Cashdollar told The Register. Str ong passw ords, a vulnerability remediation plan, and two factors of authentication can go a long way to keep systems secure from the most basic and common attacks.” Pierluigi Paganini.

IoT 92

IoT Honeypots Libraries Archiving 92

Security Affairs

MAY 17, 2020

Every week the best security articles from Security Affairs free for you in your email box. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. A new round of the weekly SecurityAffairs newsletter arrived! Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Security 53

Security Mining Ransomware Military 53

Security Affairs

JUNE 15, 2019

.” The malware also collects system information and send it back to the C2, depending on the specific hardware configuration the attackers can choose which kind of activity to carry out (i.e. launching DDoS attacker, mining cryptocurrency, etc.). to determine if it has been tampered with or has vulnerabilities).”

File names 96

File names Mining Access Communications 96

Security Affairs

JANUARY 19, 2021

The attacks aimed at compromising the tarted systems to create an IRC botnet, which can later be used to conduct several malicious activities, including DDoS attacks and crypto-mining campaign. ” continues the analysis.

Mining 138

Mining Sales IT Communications 138

Security Affairs

NOVEMBER 8, 2019

“This indicated that the same attackers were likely responsible for both coin mining campaigns—they have been actively staging coin miner attacks and eventually incorporated the BlueKeep exploit into their arsenal.” It also provides worldwide impact information, mitigation recommendations, and detection information.

Honeypots 69

Honeypots Mining Analytics Ransomware 69

Security Affairs

MAY 31, 2019

“Unlike common Linux malware, HiddenWasp is not focused on crypto-mining or DDoS activity. ” If you appreciate my effort in spreading cybersecurity awareness, please vote for Security Affairs in the section “Your Vote for the Best EU Security Tweeter” Thank you. Pierluigi Paganini.

Archiving 97

Archiving Mining Security Cybersecurity 97

Security Affairs

JULY 5, 2019

“The malware is mining XMR using the cryptonight algorithm and submits hashes to several public pools. However, this information is based only on the wallets our specific miners were using. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. conclude the experts. Pierluigi Paganini.

Passwords 90

Passwords Archiving Mining Access 90

Security Affairs

SEPTEMBER 17, 2019

The kaudited binary also drops a watchdog component used to monitor the mining process. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Another component is “ kaudited ,” s file installed as /usr/bin/ kaudited that drops and installs several loadable kernel modules (LKMs). ” Trend Micro concludes.

Passwords 82

Passwords Authentication Mining Access 82

Security Affairs

JULY 22, 2020

Prometei is a crypto-mining botnet that recently appeared in the threat landscape, it exploits the Microsoft Windows SMB protocol for lateral movements. Security experts from Cisco Talos discovered a new crypto-mining botnet, tracked as Prometei, that exploits the Microsoft Windows SMB protocol for lateral movements.

Mining 90

Mining File names Passwords Communications 90

Security Affairs

AUGUST 31, 2019

In June, Trend Micro discovered an Android crypto-currency mining botnet that can spread via open ADB (Android Debug Bridge) ports and Secure Shell (SSH). . Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Ares is a Mirai-based botnet that was one of the most active in July: Top 5 ??????????

IoT 81

IoT Passwords Mining Manufacturing 81

Security Affairs

JUNE 19, 2019

The researchers observed eight mining modules that were used to infect systems running on different processors: auto_proc, auto_cuda, auto_miner, auto_opencl_amd, auto_gpu_intel, auto_gpu_nvidia, auto_gpu_cuda, and auto_gpu_amd. . Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Mining 71

Mining Communications IT Access 71