Security Affairs

JULY 22, 2020

Prometei is a crypto-mining botnet that recently appeared in the threat landscape, it exploits the Microsoft Windows SMB protocol for lateral movements. Security experts from Cisco Talos discovered a new crypto-mining botnet, tracked as Prometei, that exploits the Microsoft Windows SMB protocol for lateral movements.

Mining 303

Mining File names Passwords Communications 303

Security Affairs

JUNE 24, 2024

Over the past year, ExCobalt targeted Russian organizations in the the following industries: Metallurgy Telecommunications Mining Information technology Government Software development The Cobalt’s hallmark was the use of the CobInt tool , the same tool that ExCobalt began using in 2022.

File names 297

File names Communications Mining Archiving 297

Security Affairs

JULY 11, 2024

The botnet shell script downloads an ELF file named “pty3” from a different IP address, likely a sample of Muhstik malware. top, which was observed in Muhstik botnet activities, and communicates via Internet Relay Chat. The script also cleans up the temporary files for obfuscation.

Honeypots 347

Honeypots File names Mining IoT 347

Security Affairs

APRIL 28, 2020

This directory contains the crypto mining module named kswapd0. In this folder, the first one to be executed is the file “a”. The script looks like the following: Figure 5: Content of the “a” file. The executed crypto miner is the file named “” kswapd0 ” based on the famous XMRIG monero crypto miner.

Mining 334

Mining File names Honeypots IT 334

Security Affairs

JUNE 15, 2019

“In this new attack, the threat actor first externally scans a given IP range by sending a TCP SYN packet to port 2375, the default port used for communicating with the Docker daemon.” “The output of this command is saved into a file named ips.txt, which is then fed into the Docker.exe file.

File names 279

File names Mining Access Communications 279

Schneier on Security

OCTOBER 14, 2024

The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency. The unknown developers of the malware gave the process a name that combines the perf Linux monitoring tool and ctl, an abbreviation commonly used with command line tools.

Mining 104

Mining File names Government Communications 104

Troy Hunt

MARCH 3, 2021

This (almost always) identifies you, it's literally how people communicate with *you*! In total, the file has 43,015 unique email addresses (including mine) which is a far cry less than the total row count. This appears to be precisely what the file name suggests - statuses posted to Gab. Coincidence?

Passwords 145

Passwords Data breaches Mining Risk 145