article thumbnail

Blue Mockingbird Monero-Mining campaign targets web apps

Security Affairs

Crooks exploit CVE-2019-18935 deserialization vulnerability to achieve remote code execution in Blue Mockingbird Monero-Mining campaign. This issue could be exploited only when the encryption keys are obtained via a separate attack, meaning that the attackers have to chain more exploits in their campaigns. Pierluigi Paganini.

Mining 84
article thumbnail

TeamTNT is back and targets servers to run Bitcoin encryption solvers

Security Affairs

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and targets Docker installs. ” The Pollard’s Kangaroo interval ECDLP solver algorithm appears to be an attempt to break the SECP256K1 encryption which is used by Bitcoin to implement its public key cryptography. Pierluigi Paganini.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

What is a Cyberattack? Types and Defenses

eSecurity Planet

Cyber criminals may damage, destroy, steal, encrypt, expose, or leak data as well as cause harm to a system. Encrypted threats spiked 167%, ransomware increased 105%, and 5.4 In May, cybersecurity researchers revealed that ransomware attacks are increasing their aggressive approach by destroying data instead of encrypting it.

article thumbnail

Threat Group TeamTNT Returns with New Cloud Attacks

eSecurity Planet

A retired threat actor has returned with new attacks aimed at the cloud, containers – and encryption keys. However, the researchers are convinced the threat actor is back, as their honeypots identified TeamTNT signatures and tools in a series of three attacks during the first week of September.

Cloud 120
article thumbnail

No, I Did Not Hack Your MS Exchange Server

Krebs on Security

Oddly, none of the several dozen antivirus tools available to scan the file at Virustotal.com currently detect it as malicious. Watson said the Krebsonsecurity file will attempt to open up an encrypted connection between the Exchange server and the above-mentioned IP address, and send a small amount of traffic to it each minute.

Honeypots 347
article thumbnail

Over 39K unauthenticated Redis services on the internet targeted in cryptocurrency campaign

Security Affairs

Redis, is a popular open source data structure tool that can be used as an in-memory distributed database, message broker or cache. The tool is not designed to be exposed on the Internet, however, researchers spotted tens thousands Redis instance publicly accessible without authentication. . SecurityAffairs – hacking, mining).

Mining 100
article thumbnail

Ezuri memory loader used in Linux and Windows malware

Security Affairs

The Ezuri memory loader tool allows to load and execute a payload directly into the memory of the infected machine, without writing any file to disk. Upon executing the code, it will ask the user the path for the payload to be encrypted and the password to be used for AES encryption to hide the malware within the loader.