Krebs on Security

JANUARY 6, 2022

Norton 360 , one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers’ computers. which was renamed to NortonLifeLock in 2019 (LifeLock is now included in the Norton 360 service). However, many users have reported difficulty removing the mining program.

Mining 354

Mining Computer and Electronics Blockchain Marketing 354

Security Affairs

DECEMBER 13, 2020

In 2018, CVE-2019-9193 was linked to this feature, naming it as a “vulnerability.” “We believe PGMiner is the first cryptocurrency mining botnet that is delivered via PostgreSQL.” In 2019, a CVE-2019-9193 was assigned to this feature, naming it as a “vulnerability.”

Mining 363

Mining Passwords Authentication Access 363

Security Affairs

SEPTEMBER 13, 2019

A new cryptocurrency-mining botnet tracked as WatchBog is heavily using the Pastebin service for command and control (C&C) operations. Cisco Talos researchers discovered a new cryptocurrency -mining botnet tracked as WatchBog is heavily using the Pastebin service for command and control. ” continues Talos.

Mining 267

Mining IT Security Information Security 267

Security Affairs

FEBRUARY 24, 2021

Security experts from Akamai have spotted a new botnet used for illicit cryptocurrency mining activities that are abusing Bitcoin (BTC) transactions to implement a backup mechanism for C2. The operators of a long-running crypto-mining botnet campaign began creatively disguising their backup C2 IP address on the Bitcoin blockchain.”

Blockchain 340

Blockchain Mining Honeypots Security 340

Security Affairs

JUNE 15, 2020

Researchers from security firm REDTEAM reported that operators behind the Black Kingdom ransomware are targeting enterprises exploiting the CVE-2019-11510 flaw in Pulse Secure VPN software to gain access to the network. The CVE-2019-11510 flaw in Pulse Connect Secure is a critical arbitrary file read vulnerability. reads the advisory.

Ransomware 348

Ransomware Mining Encryption Access 348

Security Affairs

JULY 25, 2019

Experts at Intezer researchers have spotted a strain of the Linux mining that also scans the Internet for Windows RDP servers vulnerable to the Bluekeep. ” The vulnerability , tracked as CVE-2019-0708, impacts the Windows Remote Desktop Services (RDS) and was addressed by Microsoft with May 2019 Patch Tuesday updates. .

Mining 256

Mining Encryption IT Security 256

Security Affairs

APRIL 27, 2020

The VictoryGate botnet is active since at least May 2019, the botnet is more active in Latin America the most. The VictoryGate bot propagates via infected USB devices, it was designed to mine Monero abusing resourced of compromised devices, it is also able to deliver additional payloads.

Mining 340

Mining Communications IT Security 340

Security Affairs

NOVEMBER 22, 2022

“They induced victims to enter into fraudulent equipment rental contracts with the defendants’ cryptocurrency mining service called HashFlare. ” The defendants are accused to have defrauded the victims between December 2013 and August 2019, they operated with other co-conspirators residing in Estonia, Belarus, and Switzerland.

Mining 246

Mining Marketing IT Security 246

Security Affairs

FEBRUARY 15, 2019

The removed apps are Fast-search Lite, Battery Optimizer (Tutorials), VPN Browsers+, Downloader for YouTube Videos, Clean Master+ (Tutorials), FastTube, Findoo Browser 2019, and Findoo Mobile & Desktop Search. The mining script then gets activated and begins using the majority of the computer’s CPU cycles to mine Monero for the operators.”

Mining 278

Mining Libraries Analytics Security 278

Security Affairs

JUNE 1, 2019

“The script then calls a Monero coin-mining binary, darwin (detected as PUA.Linux.XMRMiner.AA), to run in the background. As with all cryptocurrency miners, it uses the resources of the host system to mine cryptocurrency (Monero in this instance) without the owner’s knowledge.” link] — Caprico (@Suprn8) May 18, 2019.

Mining 279

Mining Honeypots Cloud Passwords 279

Security Affairs

OCTOBER 26, 2020

Security experts spotted a new botnet, tracked as KashmirBlack botnet, that likely infected hundreds of thousands of websites since November 2019. The KashmirBlack botnet has been active at least since November 2019, operators leverages dozens of known vulnerabilities in the target servers. .”

CMS 316

CMS Mining Communications Security 316

Security Affairs

APRIL 30, 2020

The campaign primarily targets users in Spain and South American countries, aims to launch a coin-mining shellcode directly in memory. The in-memory DLL then injects a coin-mining code into notepad.exe through process hollowing. .” reads the Tweet published by the Microsoft Security Intelligence team.

Mining 316

Mining File names Risk Cybersecurity 316

Security Affairs

MAY 27, 2021

The threat actors are actively exploiting the following vulnerabilities in Fortinet FortiOS: CVE-2018-13379 ; CVE-2020-12812 ; CVE-2019-5591. In April, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) previously warned of attacks carried out by APT groups targeting Fortinet FortiOS servers using multiple exploits.

Government 338

Government Mining Archiving Encryption 338

Krebs on Security

JULY 23, 2020

In May 2019, KrebsOnSecurity broke the news that the website of mortgage title insurance giant First American Financial Corp. billion in 2019. In August 2019, the company said a third-party investigation into the exposure identified just 32 consumers whose non-public personal information likely was accessed without authorization. .

Insurance 350

Insurance Financial Services Mining Access 350

Security Affairs

APRIL 22, 2022

The Lemon_Duck cryptomining botnet is targeting Docker servers to mine cryptocurrency on Linux systems. Crowdstrikes researchers reported that the Lemon_Duck cryptomining botnet is targeting Docker to mine cryptocurrency on Linux systems. “The “a.asp” file is the actual payload in this attack. ” concludes the report.

Mining 246

Mining Access Cloud Cybersecurity 246

Security Affairs

JANUARY 8, 2019

51% attack refers to an attack on a blockchain by a group of miners that controls over 50% of the network’s mining hashrate. “On 1/5/2019, Coinbase detected a deep chain reorganization of the Ethereum Classic blockchain that included a double spend. reads an update published by Coinbase on January 6, 2019.

Blockchain 279

Blockchain Mining IT Security 279

Security Affairs

JUNE 24, 2024

Over the past year, ExCobalt targeted Russian organizations in the the following industries: Metallurgy Telecommunications Mining Information technology Government Software development The Cobalt’s hallmark was the use of the CobInt tool , the same tool that ExCobalt began using in 2022.

File names 295

File names Communications Mining Archiving 295

Security Affairs

JANUARY 31, 2021

The malware is an evolution of a Monero cryptocurrency miner that was first spotted by Unit 42 researchers in 2019. to mine Monero, unlike 2019 variant, it uses a Python infection script to implement “wormable” capabilities. “Pro-Ocean uses known vulnerabilities to target cloud applications. .

Cloud 301

Cloud Libraries Mining IT 301

Security Affairs

OCTOBER 13, 2021

Avast researchers reported that since 2019, MyKings operators have amassed at least $24 million in the Bitcoin, Ethereum, and Dogecoin. Avast Threat Labs researchers reported that the MyKings botnet (aka Smominru or DarkCloud) is still alive and is allowing its operators to earn huge amounts of money via cryptomining activities.

ROT 330

ROT Mining Encryption IT 330

Security Affairs

OCTOBER 15, 2019

The cybercrime organization was first spotted in April 2018 by researchers at Cisco Talos, earlier 2019 researchers from Palo Alto Networks Unit42 found new malware samples used by the Rocke group for cryptojacking that uninstalls from Linux servers cloud security and monitoring products developed by Tencent Cloud and Alibaba Cloud.

Mining 230

Mining Cloud Security IT 230

Security Affairs

JUNE 23, 2019

Microsoft has recently addressed an important vulnerability, tracked as CVE-2019-1105, in Outlook for Android, that potentially affected over 100 million users. This one is mine. link] — Bryan Appleby (@bryapp) June 22, 2019. “ the ability to embed an iframe into an email is already a vulnerability. Case went cold.

Mining 248

Mining Access Authentication Security 248

Security Affairs

AUGUST 28, 2020

The Lemon_Duck cryptomining malware was first spotted in June 2019 by researchers from Trend Micro while targeting enterprise networks. “This aspect of the campaign expands the mining operation to support computers running Linux. ” reads the post published by Sophos.

Mining 363

Mining Passwords Authentication Access 363

Security Affairs

FEBRUARY 24, 2023

The malicious code uses i2p to download malicious components and send mined currency to the attacker’s wallet. The experts identified three generation of malware since August 2019. Today, many malicious applications continue to go undetected by most AV vendors.

Mining 246

Mining Passwords Communications Security 246

Security Affairs

MARCH 3, 2019

CVE-2019-9019 affects British Airways Entertainment System on Boeing 777-36N(ER). Recently disclosed Drupal CVE-2019-6340 RCE flaw exploited in the wild. CoinHive Cryptocurrency Mining Service will shut down on March 8, 2019. Cisco addressed CVE-2019-1663 RCE flaw in wireless routers. Kindle Edition. Paper Copy.

Security 212

Security Mining Ransomware Paper 212

Security Affairs

AUGUST 29, 2019

District Court in Seattle on September 5, 2019. According to the indictment, Paige THOMPSON created a scanning software that used to identify AWS customers who had misconfigured their firewalls, then the hacker accessed their servers to steal data, and to “mine” cryptocurrency. .” reads the press release published by DoJ.

Mining 264

Mining Cloud Data breaches Access 264

Security Affairs

JANUARY 18, 2019

Oracle released the first critical patch advisory for 2019 that addresses a total of 284 vulnerabilities, 33 of them are rated “critical”. Let’s give a close look at some of the vulnerabilities fixed by this patch advisory. The CVE-2017-5645 flaw resides in the Codehaus versions of Groovy and affected OCA Unified Inventory Management.

Financial Services 251

Financial Services Libraries Mining Retail 251

Security Affairs

NOVEMBER 18, 2020

In 2019, over 320 million users were registered with the MercadoLivre e-commerce platform. . bin, researchers also observed the use of a cryptocurrency mining module. . Chaes is written in several programming languages including Javascript, Vbscript,NET , Delphi and Node.js.

Phishing 332

Phishing Mining Libraries Encryption 332

Security Affairs

AUGUST 28, 2019

— Gendarmerie nationale (@Gendarmerie) August 28, 2019. Since it was the C&C server’s responsibility to give mining jobs to the bots, none of the bots received any new mining jobs to execute after this takedown.” Une #PremièreMondiale ! ” continues Avast.

Mining 277

Mining Ransomware IT Security 277

Security Affairs

JUNE 29, 2020

ESET researchers also said the attackers also attempt to exploit RDP connections to try to install coin-mining malware or create a backdoor. Between December 2019 and until February 2020, the experts observed a number of attacks between 70,000 and 40,000 on a daily basis.

Passwords 355

Passwords Authentication Mining Access 355

Security Affairs

FEBRUARY 19, 2019

As stated in a recent Eset report , the Shade infection had an increase during October 2018, keeping a constant trend until the second half of December 2018, taking a break around Christmas, and then resuming in mid-January 2019 doubled in size (shown in Figure 1). Trend of malicious JavaScript downloading Shade ransomware (source: ESET).

Ransomware 248

Ransomware Mining File names Encryption 248

Security Affairs

FEBRUARY 28, 2019

Nheqminer is a great implementation of equihash mining, mainly used on NiceHas but forked many times and todays is getting used for several spare projects as well. Exploring memory snapshots during its execution can be easy to figure out the miner runs over Zcash.Flypool server mining for the following wallet address. Attacker Wallet.

Ransomware 264

Ransomware Mining File names Encryption 264

Security Affairs

OCTOBER 12, 2021

The botnet appeared on the threat landscape in November 2020, the attacks aimed at compromising the target systems to create an IRC botnet, which can later be used to conduct several malicious activities, including DDoS attacks and crypto-mining campaigns. CVE-2019-12725 – Zeroshell 3.9.0. from visual-tools.com. P4410-V2-1.28

Mining 294

Mining IT Security IoT 294

Security Affairs

MARCH 21, 2022

The Windows botnet has been active since late 2017, it was mainly used to mine cryptocurrency, but it was also involved in DDoS attacks in 2018. Experts defined DirtyMoe as a complex malware that has been designed as a modular system. The executioner loads two modules, a Monero miner and a module for worming replication.

Passwords 246

Passwords Mining Risk IT 246

Security Affairs

SEPTEMBER 1, 2021

Mozi is an IoT botnet that borrows the code from Mirai variants and the Gafgyt malware , it appeared on the threat landscape in late 2019. According to the researchers, in the last months of 2019, the botnet was mainly involved in DDoS attacks.

IT 259

IT IoT Mining Manufacturing 259

Security Affairs

JANUARY 8, 2021

The loader observed by the researchers in the attacks is written in Golang and borrows the Ezuri code published on GitHub by the user guitmz in March 2019. .” reads the post published by AT&T’s Alien Labs. Experts noticed that the group also used the Ezuri loader that is similar to the original one. .

Encryption 363

Encryption Passwords Mining IT 363

Security Affairs

JULY 21, 2019

SAP Patch Day – July 2019 addresses a critical flaw in Diagnostics Agent. CVE-2019-6342 flaw allows hackers to fully compromise Drupal 8.7.4 Israel surveillance firm NSO group can mine data from major social media. Paper Copy. Once again thank you! For nearly a year, Brazilian users have been targeted with router attacks.

Security 218

Security Mining Ransomware Data collection 218

Security Affairs

JULY 5, 2019

” Attackers leverage well-known flaws to compromise target systems, including security issues in ThinkPHP (CVE-2019-9082 and CVE-unassigned) , Atlassian Confluence (CVE-2019-3396) , and the popular Drupalgeddon vulnerability (CVE-2018-7600). At the time of this writing, this operation had earned the attacker less than $2,000 USD.

Passwords 278

Passwords Archiving Mining Access 278