article thumbnail

Ngrok Mining Botnet

Security Affairs

Additionally, the campaign is sophisticated in seeking to detect, analyse and neutralise other competing crypto-mining malware. In my previous post I discussed the initial prototyping of a Docker Honeypot / Sandbox called Whaler. Firstly nearly all attacks observed were Crypto-mining attackers. Introduction. Number of CPUs.

Mining 92
article thumbnail

New Redis miner Migo uses novel system weakening techniques

Security Affairs

A new malware campaign targets Redis servers to deploy the mining crypto miner Migo on compromised Linux hosts. The campaign stands out for the use of several novel system weakening techniques against the data store itself. One of the honeypots used by Cado was targeted by an attack originating from the IP 103[.]79[.]118[.]221

Mining 108
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

No, I Did Not Hack Your MS Exchange Server

Krebs on Security

New data suggests someone has compromised more than 21,000 Microsoft Exchange Server email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name. Let’s just get this out of the way right now: It wasn’t me. krebsonsecurity[.]top top (NOT a safe domain, hence the hobbling).

Honeypots 349
article thumbnail

Free Tool: Honey Feed

Security Affairs

Cybersecurity expert Marco Ramilli shared another tool of his arsenal that extracts suspicious IPs from undesired connections, his HoneyPots. Hi folks, today I’d like to point you out another tool of mine which extracts suspicious IPs from undesired connections. In other words: HoneyPots. HoneyPot Page.

article thumbnail

Log4Shell was in the wild at least nine days before public disclosure

Security Affairs

A few hours ago, researchers at NetLab 360 reported that their Anglerfish and Apacket honeypots were already hit by attacks attempting to trigger the Log4Shell flaw in the Log4j library. ” Talos researchers also updated the list of IOCs to include information about mining activity carried out by exploiting the CVE-2021-44228 flaw.

Mining 121
article thumbnail

A Cryptomining botnet abuses Bitcoin blockchain transactions as C2 backup mechanism

Security Affairs

Security experts from Akamai have spotted a new botnet used for illicit cryptocurrency mining activities that are abusing Bitcoin (BTC) transactions to implement a backup mechanism for C2. The operators of a long-running crypto-mining botnet campaign began creatively disguising their backup C2 IP address on the Bitcoin blockchain.”

article thumbnail

TeamTNT is back and targets servers to run Bitcoin encryption solvers

Security Affairs

In the first week of September, AquaSec researchers identified at least three different attacks targeting their honeypots, the experts associated them with the cybercrime gang TeamTNT. The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and targets Docker installs.