Krebs on Security

JANUARY 6, 2022

Norton 360 , one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers’ computers. According to the FAQ posted on its site , “ Norton Crypto ” will mine Ethereum (ETH) cryptocurrency while the customer’s computer is idle. ” reads a Dec.

Mining 352

Mining Computer and Electronics Blockchain Marketing 352

Security Affairs

JANUARY 10, 2022

Experts linked the C2 infrastructure behind an the Abcbot botnet to a cryptocurrency-mining botnet attack that was uncovered in December 2020. Experts linked the infrastructure used by the Abcbot DDoS botnet to the operations of a cryptocurrency-mining botnet that was uncovered in December 2020. Pierluigi Paganini.

Mining 275

Mining Honeypots Cloud Security 275

Security Affairs

JULY 26, 2020

Every week the best security articles from Security Affairs free for you in your email box. The post Security Affairs newsletter Round 274 appeared first on Security Affairs. A new round of the weekly SecurityAffairs newsletter arrived! Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Security 240

Security Mining Ransomware Phishing 240

Security Affairs

MAY 1, 2021

“The QNAP security team has detected suspicious ransomware in the wild known as AgeLocker, which has the potential to affect QNAP NAS devices.” ” reads the security advisory published by the vendor. “To further secure your device, do not expose your NAS to the internet. ” continues the advisory.

Ransomware 359

Ransomware Mining Security IT 359

Security Affairs

MAY 4, 2020

A few days ago, researchers from F-Secure disclosed a number of vulnerabilities in the “Salt” framework, including two issues that could be exploited by attackers to take over Salt installations. A few hours later another security incident was reported by the media, ZDNet reported that the Node.js-based Pierluigi Paganini.

Mining 351

Mining Authentication Ransomware Access 351

Security Affairs

FEBRUARY 24, 2021

Security experts from Akamai have spotted a new botnet used for illicit cryptocurrency mining activities that are abusing Bitcoin (BTC) transactions to implement a backup mechanism for C2. The operators of a long-running crypto-mining botnet campaign began creatively disguising their backup C2 IP address on the Bitcoin blockchain.”

Blockchain 337

Blockchain Mining Honeypots Security 337

Security Affairs

MAY 26, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. The malware deploys the XMRig mining tool to mine Monero cryptocurrency. Executes the script to start mining for the Monero cryptocurrency. aws/credentials and ~/.aws/config

Mining 352

Mining Cloud Security Access 352

Security Affairs

SEPTEMBER 9, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. Experts pointed out that even if the group is expanding its arsenal adding new capabilities, it still focuses on cryptocurrency mining. ” reads the analysis published by AT&T.

Mining 302

Mining IT Cloud Security 302

Security Affairs

JUNE 22, 2021

DirtyMoe is a Windows botnet that is rapidly growing, it passed from 10,000 infected systems in 2020 to more than 100,000 in the first half of 2021. The Windows botnet has been active since late 2017, it was mainly used to mine cryptocurrency, but it was also involved in DDoS attacks in 2018. Pierluigi Paganini.

Mining 363

Mining Passwords Communications IT 363

Security Affairs

JUNE 18, 2022

MaliBot disguises itself as a cryptocurrency mining app named “Mining X” or “The CryptoApp”, experts also observed the malicious code masqueraded as “MySocialSecurity” and “Chrome” apps. ” Security Affairs is one of the finalists for the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS.

Mining 362

Mining Access Phishing Authentication 362

Security Affairs

APRIL 30, 2020

— Microsoft Security Intelligence (@MsftSecIntel) April 28, 2020. ” reads the Tweet published by the Microsoft Security Intelligence team. . ” reads the Tweet published by the Microsoft Security Intelligence team. — Microsoft Security Intelligence (@MsftSecIntel) April 28, 2020.

Mining 310

Mining File names Risk Cybersecurity 310

Security Affairs

JUNE 27, 2021

Researchers have discovered a strain of cryptocurrency-mining malware, tracked as Crackonosh, that abuses Windows Safe mode to avoid detection. . Later the experts discovered that Crackonosh was also able to disable antivirus software from other major security vendors to avoid detection, including Windows Defender and Windows Update.

Mining 358

Mining File names Security IT 358

Security Affairs

DECEMBER 13, 2020

Security researchers from Palo Alto Networks have discovered a new botnet, tracked as PgMiner, that targets PostgreSQL databases running on Linux servers to install a cryptocurrency miner. It ranks fourth among all database management systems (DBMS) as of November 2020. ” reads the analysis published by Palo Alto Networks Unit42.

Mining 363

Mining Passwords Authentication Access 363

WIRED Threat Level

JANUARY 4, 2023

When police infiltrated the EncroChat phone system in 2020, they hit an intelligence gold mine. But subsequent legal challenges have spread across Europe.

Mining 250

Mining IT Security 250

Security Affairs

FEBRUARY 2, 2024

” In June 2021, researchers from Avast warned of the rapid growth of the DirtyMoe botnet ( PurpleFox , Perkiler , and NuggetPhantom ), which passed from 10,000 infected systems in 2020 to more than 100,000 in the first half of 2021. .” ” reads the alert published by CERT-UA.

Mining 336

Mining Passwords Government IT 336

Security Affairs

OCTOBER 28, 2020

billion in 2020. In an 8-K form filed with the Securities and Exchange Commission (SEC), the company has disclosed the ransomware attack that took place on October 22nd, 2020. “On October 22, 2020, Steelcase Inc. . “On October 22, 2020, Steelcase Inc. Steelcase has 13,000 employees and $3.7

Ransomware 318

Ransomware Computer and Electronics Manufacturing Mining 318

Security Affairs

MAY 27, 2021

In April, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) previously warned of attacks carried out by APT groups targeting Fortinet FortiOS servers using multiple exploits. The threat actors are actively exploiting the following vulnerabilities in Fortinet FortiOS: CVE-2018-13379 ; CVE-2020-12812 ; CVE-2019-5591.

Government 335

Government Mining Archiving Encryption 335

Security Affairs

JANUARY 21, 2021

QNAP is warning customers of a new piece of malware dubbed Dovecat that is targeting NAS devices to mine cryptocurrency. Taiwanese vendor QNAP has published a security advisory to warn customers of a new piece of malware named Dovecat that is targeting NAS devices. ” reads the security advisory published by the vendor.

Mining 306

Mining Passwords Ransomware Security 306

Security Affairs

AUGUST 28, 2020

Security researchers from Sophos have spotted a new variant of the Lemon_Duck cryptomining malware that has been updated to compromise Linux machines via SSH brute force attacks. The authors of the Lemon_Duck cryptomining malware have also added a module that exploits the SMBGhost (CVE-2020-0796) Windows SMBv3 Client/Server RCE.

Mining 363

Mining Passwords Authentication Access 363

Security Affairs

DECEMBER 1, 2020

New blog: The threat actor BISMUTH, which has been running increasingly complex targeted attacks, deployed coin miners in campaigns from July to August 2020. Learn how the group tried to stay under the radar using threats perceived to be less alarming: [link] — Microsoft Security Intelligence (@MsftSecIntel) November 30, 2020.

Mining 338

Mining Manufacturing Government Phishing 338

Security Affairs

JANUARY 19, 2021

Security researchers uncovered a series of attacks conducted by the FreakOut botnet that leveraged recently discovered vulnerabilities. Security researchers from Check Point have uncovered a series of attacks associated with the FreakOut botnet that is targeting multiple unpatched flaws in applications running on top of Linux systems.

Mining 360

Mining Sales IT Communications 360

Security Affairs

JANUARY 8, 2021

“In October 2020, Palo Alto Networks Unit42 identified new variants of the cryptomining malware used by TeamTNT named “Black-T.” . The decrypted payload is an ELF file packed with UPX, which is a known sample from TeamTNT, first seen in June 2020 ( e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3 ).”

Encryption 363

Encryption Passwords Mining IT 363

Security Affairs

JANUARY 28, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. ” If you want to receive the weekly Security Affairs Newsletter for free subscribe here. Pierluigi Paganini. SecurityAffairs – hacking, malware).

Libraries 352

Libraries IT Mining Security 352

Security Affairs

OCTOBER 12, 2021

The botnet appeared on the threat landscape in November 2020, the attacks aimed at compromising the target systems to create an IRC botnet, which can later be used to conduct several malicious activities, including DDoS attacks and crypto-mining campaigns. from visual-tools.com. CVE-2021-2900 – Genexis PLATINUM 4410 2.1 P4410-V2-1.28

Mining 291

Mining IT Security IoT 291

Security Affairs

FEBRUARY 5, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. The malware deploys the XMRig mining tool to mine Monero cryptocurrency. If you want to receive the weekly Security Affairs Newsletter for free subscribe here. aws/credentials and ~/.aws/config

Mining 295

Mining Libraries Encryption Access 295

Security Affairs

APRIL 22, 2022

The Lemon_Duck cryptomining botnet is targeting Docker servers to mine cryptocurrency on Linux systems. Crowdstrikes researchers reported that the Lemon_Duck cryptomining botnet is targeting Docker to mine cryptocurrency on Linux systems. “The “a.asp” file is the actual payload in this attack. ” concludes the report.

Mining 246

Mining Access Cloud Cybersecurity 246

Security Affairs

JUNE 29, 2020

Security experts from ESET revealed that the number of daily brute-force attacks on Windows RDP has doubled during the COVID-19 lockdown. ESET researchers also said the attackers also attempt to exploit RDP connections to try to install coin-mining malware or create a backdoor. China, Russia, Germany, and France. Pierluigi Paganini.

Passwords 354

Passwords Authentication Mining Access 354

Security Affairs

DECEMBER 2, 2020

Security researcher Tolijan Trajanovski ( @tolisec ) analyzed the multi-vector Miner+Tsunami Botnet that implements SSH lateral movement. A fellow security researcher, 0xrb , shared with me samples of a botnet that propagates using weblogic exploit. Stage 1 – WebLogic exploit CVE-2020-14882. Botnet Summary. 8080 209.141.35.17:8080.

Mining 343

Mining IoT Cloud Security 343

Security Affairs

JANUARY 3, 2021

In early 2020, a joint operation conducted by the FBI in coordination with the UK NCA, the Netherlands National Police Corps, the German Bundeskriminalamt, and the Police Service of Northern Ireland resulted in the seizure of the WeLeakInfo.com domain. .” ” reads the announcement published by the UK NCA. Pierluigi Paganini.

Data breaches 350

Data breaches Mining Access Archiving 350

Security Affairs

SEPTEMBER 17, 2021

CVE-2020-14882 Oracle WebLogic Server RCE, and CVE-2018-20062 ThinkPHP RCE) and targeting sites and systems protected with weak administrative credentials. Upon infecting a system, the malware abuses its resources to mine cryptocurrency. . The malware spread through attacks exploiting known vulnerabilities (i.e. Pierluigi Paganini.

Honeypots 279

Honeypots Mining Encryption Access 279

Krebs on Security

JULY 29, 2021

There, denizens with computer rigs that are built primarily for mining virtual currencies can set to work using those systems to crack passwords. But a decent crypto-mining rig can quickly crack a majority of password hashes generated with MD5 (one of the weaker and more commonly-used password hashing algorithms).

Passwords 363

Passwords Phishing Mining Data breaches 363

Security Affairs

JUNE 19, 2021

“RedFoxtrot has primarily targeted aerospace and defense, government, telecommunications, mining, and research organizations in Afghanistan, India, Kazakhstan, Kyrgyzstan, Pakistan, Tajikistan, and Uzbekistan. Experts noticed that RedFoxtrot activity overlaps with groups tracked by other security firms as Temp.Trident and Nomad Panda.

Military 335

Military Mining Government Communications 335

The Last Watchdog

OCTOBER 28, 2021

However, these attacks aren’t due to exchange security flaws; malicious actors are exploiting the underlying consensus protocols of blockchains themselves. However, there are solutions blockchains can adopt to drastically increase their security without attracting any more mining power.

Blockchain 203

Blockchain Mining Security IT 203

Security Affairs

OCTOBER 13, 2021

.” The malware was first spotted in February 2018 by researchers from Proofpoint when the bot was using the EternalBlue exploit to infect Windows computers and recruit them in Monero cryptocurrency mining activities. The post MyKings botnet operators already amassed at least $24 million appeared first on Security Affairs.

ROT 326

ROT Mining Encryption IT 326

Security Affairs

NOVEMBER 18, 2020

Cybereason Nocturnus security researchers have identified an active campaign focused on the users of a large e-commerce platform in Latin America. bin, researchers also observed the use of a cryptocurrency mining module. . In 2019, over 320 million users were registered with the MercadoLivre e-commerce platform. .

Phishing 329

Phishing Mining Libraries Encryption 329

Security Affairs

NOVEMBER 9, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. The post TeamTNT group targets poorly configured Docker servers exposing REST APIs appeared first on Security Affairs. ” continues the analysis. Pierluigi Paganini.

Mining 287

Mining Security IT Information Security 287

Security Affairs

AUGUST 19, 2020

Researchers spotted a new sophisticated peer-to-peer (P2P) botnet, dubbed FritzFrog, that has been actively targeting SSH servers since January 2020. FritzFrog is a new sophisticated botnet that has been actively targeting SSH servers worldwide since January 2020. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Encryption 363

Encryption Mining Communications Access 363