article thumbnail

Ngrok Mining Botnet

Security Affairs

Additionally, the campaign is sophisticated in seeking to detect, analyse and neutralise other competing crypto-mining malware. In my previous post I discussed the initial prototyping of a Docker Honeypot / Sandbox called Whaler. Firstly nearly all attacks observed were Crypto-mining attackers. Introduction.

Mining 92
article thumbnail

Vulnerable Docker Installations Are A Playhouse for Malware Attacks

Security Affairs

Uptycs researchers identified ongoing malicious campaigns through our Docker honeypot targeting exposed Docker API. The Uptycs Threat Research team has identified ongoing malicious campaigns through our Docker honeypot targeting exposed Docker API port 2375. Figure 7:honeypot log – crypto miner attack. Figure 8: aaa.sh

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Free Tool: Honey Feed

Security Affairs

Cybersecurity expert Marco Ramilli shared another tool of his arsenal that extracts suspicious IPs from undesired connections, his HoneyPots. Hi folks, today I’d like to point you out another tool of mine which extracts suspicious IPs from undesired connections. In other words: HoneyPots. HoneyPot Page.

article thumbnail

Log4j Vulnerability Aftermath

Security Affairs

Using our threat intelligence systems and honeypot, the Uptycs threat research team identified different kinds of payloads dropped on the vulnerable servers. Xmrig is an open sourced Monero CPU Miner used to mine Monero cryptocurrency. Coinminers. Figure 1: Shell script downloading and executing Xmrig. DDoS botnet payloads.

article thumbnail

Multiple threat actors are targeting Elasticsearch Clusters

Security Affairs

Cisco Talos experts have reported a spike in the attacks that leverage known flaws to compromise unsecured Elasticsearch clusters and use them to mine crypto-currencies. “Through ongoing analysis of honeypot traffic, Talos detected an increase in attacks targeting unsecured Elasticsearch clusters.

article thumbnail

Outlaw is Back, a New Crypto-Botnet Targets European Organizations

Security Affairs

This directory contains the crypto mining module named kswapd0. This component has two main functions: Install a cryptoMiner worker: The main purpose of this elf file is the instantiation of a crypto-mining worker. It is a fork of XMRIG project, one of the most popular software to mine monero crypto values.

Mining 101
article thumbnail

New Linux coin miner kills competing malware to maximize profits

Security Affairs

Security experts from Trend Micro have discovered a new strain of coin miner that targets the Linux platform and installs the XMR-Stak Cryptonight cryptocurrency miner, researchers observed it killing other Linux malware and coin miners present on the infected machine. ” reads the analysis published by Trend Micro.