Forest Global Training Partners

Cyber Risks · Cisco Talos

Lemon Duck brings cryptocurrency miners back into the spotlight

Summary: Cisco Talos documented the Lemon Duck botnet, a multi-modular threat with a Monero cryptocurrency mining payload that spreads via infected RTF email attachments, psexec, WMI, SMB exploits including Eternal Blue (CVE-2017-0144) and SMBGhost, and RDP brute-forcing. Talos observed a rise in DNS requests to the t.amynx.com command-and-control server toward the end of August 2020, with the top five originating countries being Iran, Egypt, the Philippines, Vietnam and India.

Why it matters: The botnet carries a killer module built to disable competing cryptocurrency miners and uses Mimikatz to harvest credentials for brute-forcing SMB, RDP and SSH, so an infection does not stay contained to one host. Eternal Blue, disclosed in a Shadow Brokers leak more than three years before this campaign, remains a working lateral-movement path in the spreader.

Read the original at Cisco Talos ↗

Topics
Malware
Related