Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
Summary: Unit 42 researchers discovered a hybrid malware dubbed Lucifer on May 29, 2020, through incidents exploiting CVE-2019-9081, and the campaign resumed June 11, 2020 with an upgraded version after a first wave stopped June 10. Lucifer drops XMRig to mine Monero, performs C2 operations and self-propagation via credential brute-forcing and exploits including EternalBlue, EternalRomance, DoublePulsar, CVE-2017-0144, CVE-2017-0145 and CVE-2017-8464, and can carry out TCP/UDP/HTTP DoS attacks.
Key Takeaway: The XMR wallet tied to this campaign had paid out 0.493527 XMR, roughly $32 USD, while the malware weaponizes high and critical Windows vulnerabilities whose patches are readily available.