Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs
Summary: Since April 2021, Cisco Talos has observed updated Lemon Duck cryptocurrency-mining botnet infrastructure and new components targeting unpatched Microsoft Exchange Servers and attempting to download and execute payloads for Cobalt Strike DNS beacons. The actor targets CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065, reported on March 2, 2021 and affecting Exchange Server 2013, 2016 and 2019, and has generated fake domains on East Asian country-code TLDs to mask connections to its legitimate C2 domain since at least February 2020.
Key Takeaway: Lemon Duck's tooling now uses CertUtil to pull PowerShell scripts that uninstall ESET and Kaspersky, stop Windows Defender and wuauserv, disable Windows Firewall, and set up a scheduled task running every 50 minutes - so a single unpatched Exchange server can hand an actor the means to strip your endpoint defenses before the miner even starts.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026