File names, Mining and Security - Information Management Today

Atlassian Confluence bug CVE-2022-26134 exploited in cryptocurrency mining campaign

Security Affairs

SEPTEMBER 22, 2022

Threat actors are targeting unpatched Atlassian Confluence servers as part of an ongoing crypto mining campaign. Trend Micro researchers warn of an ongoing crypto mining campaign targeting Atlassian Confluence servers affected by the CVE-2022-26134 vulnerability. The gap is being abused for malicious cryptocurrency mining.”

Mining

Mining File names Ransomware Cloud

Prometei, a new modular crypto-mining botnet exploits Windows SMB

Security Affairs

JULY 22, 2020

Prometei is a crypto-mining botnet that recently appeared in the threat landscape, it exploits the Microsoft Windows SMB protocol for lateral movements. Security experts from Cisco Talos discovered a new crypto-mining botnet, tracked as Prometei, that exploits the Microsoft Windows SMB protocol for lateral movements.

Mining

Mining File names Passwords Communications

Microsoft warns of Dexphot miner, an interesting polymorphic threat

Security Affairs

NOVEMBER 26, 2019

Security experts at Microsoft analyzed a new strain of cryptocurrency miner tracked as Dexphot that has been active since at least October 2018. The malicious code abuse of the resources of the infected machine to mine cryptocurrency , according to the experts it has already infected 80,000 computers worldwide. Pierluigi Paganini.

File names

File names Encryption Mining Security

Webinars

How to Achieve High-Accuracy Results When Using LLMs

MORE WEBINARS

Crackonosh Monero miner made $2M after infecting 222,000 Win systems

Security Affairs

JUNE 27, 2021

Researchers have discovered a strain of cryptocurrency-mining malware, tracked as Crackonosh, that abuses Windows Safe mode to avoid detection. . Later the experts discovered that Crackonosh was also able to disable antivirus software from other major security vendors to avoid detection, including Windows Defender and Windows Update.

Mining

Mining File names Security IT

A new Linux Botnet abuses IaC Tools to spread and other emerging techniques

Security Affairs

APRIL 23, 2021

The botnet is currently involved in cryptocurrency mining activity, it delivers the XMRig Monero (XMR) miner onto the infected machines. The binary includes a configuration file and unlike other cryptocurrency miners, it uses its own mining pool instead of public pools to make tracking attackers even more difficult.

Mining

Mining File names Security IT

Crooks spread malware via pirated movies during COVID-19 outbreak

Security Affairs

APRIL 30, 2020

We saw an active coin miner campaign that inserts a malicious VBScript into ZIP files posing as movie downloads. — Microsoft Security Intelligence (@MsftSecIntel) April 28, 2020. Experts observed an ongoing coin miner campaign that injects a malicious VBScript into ZIP files posing as movie downloads. Pierluigi Paganini.

Mining

Mining File names Risk Cybersecurity

Multiple threat actors exploit PHP flaw CVE-2024-4577 to deliver malware

Security Affairs

JULY 11, 2024

Multiple threat actors exploit a recently disclosed security PHP flaw CVE-2024-4577 to deliver multiple malware families. Cybersecurity and Infrastructure Security Agency (CISA) added the the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The script also cleans up the temporary files for obfuscation.

Honeypots

Honeypots File names Mining IoT

ExCobalt Cybercrime group targets Russian organizations in multiple sectors

Security Affairs

JUNE 24, 2024

Over the past year, ExCobalt targeted Russian organizations in the the following industries: Metallurgy Telecommunications Mining Information technology Government Software development The Cobalt’s hallmark was the use of the CobInt tool , the same tool that ExCobalt began using in 2022.

File names

File names Communications Mining Archiving

New NRSMiner cryptominer NSA-Linked EternalBlue Exploit

Security Affairs

JANUARY 4, 2019

” reads the analysis published by F-Secure. The new version of NRSMiner updates existing infections by downloading new modules and removing files and services installed by old previous versions. This malicious code first installs a service named snmpstorsrv , with snmpstorsrv.dll registered as servicedll. traduires[.]com

Mining

Mining File names IT Access

The Long Run of Shade Ransomware

Security Affairs

FEBRUARY 19, 2019

Since the beginning of the year, security firms observed a new intense ransomware campaign spreading the Shade ransomware. Between January and February, a new, intense, ransomware campaign has been observed by many security firms. It contains a russian speaking JavaScript file named “«??? «??? «?????????» ??????????? ??????”,

Ransomware

Ransomware Mining File names Encryption

Outlaw is Back, a New Crypto-Botnet Targets European Organizations

Security Affairs

APRIL 28, 2020

This directory contains the crypto mining module named kswapd0. In this folder, the first one to be executed is the file “a”. The script looks like the following: Figure 5: Content of the “a” file. The executed crypto miner is the file named “” kswapd0 ” based on the famous XMRIG monero crypto miner.

Mining

Mining File names Honeypots IT

Ransomware, Trojan and Miner together against “PIK-Group”

Security Affairs

FEBRUARY 28, 2019

Security expert Marco Ramilli analyzed a new piece of malware apparently designed to target PIK-Group that implements ransomware , Trojan, and Miner capabilities. So I clicked on the link (see IOC section) and I’ve downloaded a “pik.zip” file. According to zcashnetwork the attacker’s wallet received from mining activity 4.89

Ransomware

Ransomware Mining File names Encryption

BlackSquid malware uses multiple exploits to drop cryptocurrency miners

Security Affairs

JUNE 5, 2019

Security experts at Trend Micro have discovered a new Monero cryptomining miner, dubbed BlackSquid, that is targeting web servers, network drives, and removable drives. “This malware, which we named BlackSquid after the registries created and main component file names, is particularly dangerous for several reasons.”

Mining

Mining File names Libraries IT

Crooks exploit exposed Docker APIs to build AESDDoS botnet

Security Affairs

JUNE 15, 2019

. “A batch file first executes the WinEggDrop scanner (s.exe), which tries port 2375 on various hosts with Chinese IP address ranges specified in the ip.txt file.” “The output of this command is saved into a file named ips.txt, which is then fed into the Docker.exe file. Pierluigi Paganini.

File names

File names Mining Access Communications

Multiple threat actors are targeting Elasticsearch Clusters

Security Affairs

FEBRUARY 27, 2019

Security researchers at Cisco Talos are warning of a spike in attacks on unsecured Elasticsearch clusters to drop cryptocurrency miners. Cisco Talos experts have reported a spike in the attacks that leverage known flaws to compromise unsecured Elasticsearch clusters and use them to mine crypto-currencies. Pierluigi Paganini.

Search queries

Search queries Honeypots File names Mining

Experts spotted P2P worm spreading Crypto-Miners in the wild

Security Affairs

JULY 23, 2019

Recently, our threat monitoring operations pointed us to an interesting file named “ Lucio Dalla Discografia Completa ”: this file pretends to be a collection of the discography of a famous I talian singer, but it actually hides malicious intents. . Code Snippet 1: Copy of the files in a subfolder. tmp” and “64.tmp”,

Archiving

Archiving Mining File names Risk

The 773 Million Record "Collection #1" Data Breach

Troy Hunt

JANUARY 16, 2019

If @1Password was to integrate with my newly released Pwned Passwords k-Anonymity model so you could securely check your exposure against the service (it'd have to be opt in, of course). My hope is that for many, this will be the prompt they need to make an important change to their online security posture. Oh wow - look at this!

Data breaches

Data breaches Passwords Risk Personal data

Nansh0u campaign already infected 50,000 MS-SQL and PHPMyAdmin Servers

Security Affairs

MAY 29, 2019

Security experts at Guardicore Labs uncovered a widespread cryptojacking campaign leveraging a malware dubbed Nansh0u. The payloads used in this campaign were droppers used to deliver a cryptocurrency miner to mine TurtleCoin cryptocurrency. The malicious code aimed at Windows MS-SQL and PHPMyAdmin servers worldwide.

File names

File names Mining Security Cybersecurity

Inside the "3 Billion People" National Public Data Breach

Troy Hunt

AUGUST 13, 2024

Because that doesn't reconcile with reports about "nearly 3 billion people" with social security numbers exposed. Do take note of the file name in the embedded image, though - "people_data-935660398-959524741.csv" I wonder if the data from that story lines up with the file in the image above?

Data breaches

Data breaches Archiving File names Mining

Perfectl Malware

Schneier on Security

OCTOBER 14, 2024

It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said. The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency.

Mining

Mining File names Government Communications

Gab Has Been Breached

Troy Hunt

MARCH 3, 2021

Most organisation begin with "we take the security of your data seriously", layer on lawyer speak, talk about credit cards not being exposed and then promise to provide further updates as they come to hand. In total, the file has 43,015 unique email addresses (including mine) which is a far cry less than the total row count.

Passwords

Passwords Data breaches Mining Risk

Information Management Today

Atlassian Confluence bug CVE-2022-26134 exploited in cryptocurrency mining campaign

Prometei, a new modular crypto-mining botnet exploits Windows SMB

Webinars

Trending Sources

Microsoft warns of Dexphot miner, an interesting polymorphic threat

Webinars

Crackonosh Monero miner made $2M after infecting 222,000 Win systems

A new Linux Botnet abuses IaC Tools to spread and other emerging techniques

Crooks spread malware via pirated movies during COVID-19 outbreak

Multiple threat actors exploit PHP flaw CVE-2024-4577 to deliver malware

ExCobalt Cybercrime group targets Russian organizations in multiple sectors

New NRSMiner cryptominer NSA-Linked EternalBlue Exploit

The Long Run of Shade Ransomware

Outlaw is Back, a New Crypto-Botnet Targets European Organizations

Ransomware, Trojan and Miner together against “PIK-Group”

BlackSquid malware uses multiple exploits to drop cryptocurrency miners

Crooks exploit exposed Docker APIs to build AESDDoS botnet

Multiple threat actors are targeting Elasticsearch Clusters

Experts spotted P2P worm spreading Crypto-Miners in the wild

The 773 Million Record "Collection #1" Data Breach

Nansh0u campaign already infected 50,000 MS-SQL and PHPMyAdmin Servers

Inside the "3 Billion People" National Public Data Breach

Perfectl Malware

Gab Has Been Breached

Stay Connected