Name: Windows and Linux devices are under attack by a new cryptomining worm
Brand: arstechnica.com
SKU: arstechnica-com-353
Availability: OnlineOnly

critic

Windows and Linux devices are under attack by a new cryptomining worm

preview

A newly discovered cryptomining worm is stepping up its targeting of Windows and Linux devices with a batch of new exploits and capabilities, a researcher said.Research company Juniper started monitoring what it’s calling the Sysrv botnet in December. One of the botnet’s malware components was a worm that spread from one vulnerable device to another without requiring any user action. It did this by scanning the Internet for vulnerable devices and, when found, infecting them using a list of exploits that has increased over time.The malware also included a cryptominer that uses infected devices to create the Monero digital currency. There was a separate binary file for each component.By March, Sysrv developers had redesigned the malware to combine the worm and miner into a single binary. They also gave the script that loads the malware the ability to add SSH keys, most likely as a way to make it better able to survive reboots and to have more sophisticated capabilities. The worm was exploiting six vulnerabilities in software and frameworks used in enterprises, including Mongo Express, XXL-Job, XML-RPC, Saltstack, ThinkPHP, and Drupal Ajax.“Based on the binaries we have seen and the time when we have seen them, we found that the threat actor is constantly updating its exploit arsenal,” Juniper researcher Paul Kimayong said in a .Thursday’s post listed more than a dozen exploits that are under attack by the malware. They are:ExploitSoftwareCVE-2021-3129LaravelCVE-2020-14882Oracle WeblogicCVE-2019-3396Widget Connector macro in Atlassian Confluence ServerCVE-2019-10758Mongo ExpressCVE-2019-0193Apache SolrCVE-2017-9841PHPUnitCVE-2017-12149Jboss Application ServerCVE-2017-11610Supervisor (XML-RPC)Apache Hadoop Unauthenticated Command Execution via YARN ResourceManager (No CVE)Apache HadoopBrute force JenkinsJenkinsJupyter Notebook Command Execution (No CVE)Jupyter Notebook ServerCVE-2019-7238Sonatype Nexus Repository ManagerTomcat Manager Unauth Upload Command Execution (No CVE)Tomcat ManagerWordPress BruteforceWordPressThe exploits Juniper Research previously saw the malware using are:The developers have also changed the mining pools that infected devices join. The miner is a version of the open source XMRig&nbsp;that currently mines for the following mining pools:A mining pool is a group of cryptocurrency miners who combine their computational resources to reduce the volatility of their returns and increase the chances of finding a block of transactions. According to mining pool profitability comparison site , the pools used by Sysrv are three of the four top Monero mining pools.“Combined together, they almost have 50% of the network hash rate,” Kimayong wrote. “The threat actor’s criteria appears to be top mining pools with high reward rates.”The profit from mining is deposited into the following wallet address:49dnvYkWkZNPrDj3KF8fR1BHLBfiVArU6Hu61N9gtrZWgbRptntwht5JUrXX1ZeofwPwC6fXNxPZfGjNEChXttwWE3WGURashows that the wallet gained 8 XMR, worth roughly $1,700, from March 1 to March 28. It's adding about 1 XMR every two days.The Sysrv binary is a 64-bit Go binary that’s packed with the open source UPX executable packer. There are versions for both Windows and Linux. Two Windows binaries chosen at random were detected by and of the top 70 malware protection services, according to VirusTotal. Two randomly picked Linux binaries had and .The threat from this botnet isn’t just the strain on computing resources and the non-trivial drain of electricity. Malware that has the ability to run a cryptominer can almost certainly also install ransomware and other malicious wares. Thursday’s blog post has dozens of indicators that administrators can use to see if the devices they manage are infected.You must to comment.

A newly discovered cryptomining worm is stepping up its targeting of Windows and Linux devices with a batch of new exploits and capabilities, a researcher said.Research company Juniper started monitoring what it’s calling the Sysrv botnet in December. One of the botnet’s malware components was a worm that spread from one vulnerable device to another without requiring any user action. It did this by scanning the Internet for vulnerable devices and, when found, infecting them using a list of exploits that has increased over time.The malware also included a cryptominer that uses infected...

public

Dan Goodin

Ars Technica is a website covering news and opinions in technology, science, politics, and society, created by Ken Fisher and Jon Stokes in 1998. It publishes news, reviews, and guides on issues such as computer hardware and software, science, technology policy, and video games. Many of the site's writers are postgraduates and some work for research institutions. Articles on the website are written in a less-formal tone than those in traditional journals. Ars Technica was privately owned until May 2008, when it was sold to Condé Nast Digital, the online division of Condé Nast Publications.

Windows and Linux devices are under attack by a new cryptomining worm

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS