Microsoft exposes a cryptojacking campaign using SEO poisoning and ScreenConnect to target high-performance PCs, with malicious sites also surfaced through AI chatbots.

Learn about CoinMiner Malware and how it is distributed via USB devices to secretly mine cryptocurrency on victims' computers.

 The attackers are leveraging SourceForge to distribute fraudulent Microsoft add-ins that install malware on victims' PCs to mine and siphon crypto. SourceForge.net is a legitimate software hosting and distribution platform that also offers version control, issue tracking, and dedicated forums/wikis, making it a popular choice among open-source project communities.  Although its open project submission methodology allows for lots of abuse, malware is rarely disseminated through it. The novel campaign discovered by Kaspersky has affected approximately 4,604 systems, the majority of which are in Russia. While the malicious project is no longer available on SourceForge, Kaspersky claims it was indexed by search engines, resulting in traffic from visitors searching for "office add-ins" or something similar. Fraudulent office add-ins The "officepackage" project poses as a set of development tools for Office Add-ins, and its files and description are a replica of the official Microsoft project "Office-Addin-Scripts," which is accessible on GitHub.  However, when people search for office add-ins on Google (and other engines), they are directed to "officepackage.sourceforge.io," which is powered by a distinct web hosting service provided by SourceForge to project owners. That page displays the "Office Add-ins" and "Download" buttons, just like a genuine developer tool page would. The victim receives a ZIP file with a password-protected package (installer.zip) and a text file with the password if any are clicked. The archive contains an MSI file (installer.msi) that has been inflated to 700MB in size to avoid antivirus scans. When it runs, it deletes 'UnRAR.exe' and '51654.rar' and launches a Visual Basic script that downloads a batch script (confvk.bat) from GitHub.  The script first checks to see if it is running in a simulated environment and what antivirus products are active, before downloading another batch script (confvz.bat) and unpacking the RAR package.  The confvz.bat script establishes persistence through Registry changes and the addition of Windows services. The RAR file includes the AutoIT interpreter (Input.exe), the Netcat reverse shell program (ShellExperienceHost.exe), and two payloads (Icon.dll and Kape.dll).  The DLL files include a cryptocurrency miner and a clipper. The first uses the machine's CPU capacity to mine bitcoin for the attacker's account, while the second scans the clipboard for copied cryptocurrency addresses and replaces them with attacker-controlled ones.  The attacker also receives information from the infected device via Telegram API calls and can use the same channel to deliver further payloads to the compromised machine. This effort is another example of threat actors using any lawful site to establish bogus legitimacy and circumvent security measures.

ASEC reported attacks against poorly managed Linux servers where propagation malware was used to deploy XMRig CoinMiner, with ShellBot, MIG LogCleaner, and XHide also involved. The campaign has been active since at least 2023 and uses Go-based downloaders and malware, Shc scripts, SSH scanning, and persistence mechanisms to sustain infection and...

GeoServer's RCE flaw (CVE-2024-36401) is actively exploited to deploy NetCat reverse shells and XMRig CoinMiners on Windows/Linux, hijacking resources.

Last week, we saw a supply-chain attack against the Ultralytics AI library on GitHub. A quick summary: On December 4, a malicious version 8.3.41 of the popular AI library ultralytics ­—which has almost 60 million downloads—was published to the Python Package Index (PyPI) package repository. The package contained downloader code that was downloading the XMRig coinminer. The compromise of the project’s build environment was achieved by exploiting a known and previously reported GitHub Actions script injection. Lots more details at that link. Also ...

Hackers can hide their names and access the blocked websites or networks by using proxy servers which help in making these systems anonymous.

These packages demonstrate a sophisticated multi-phase attack pattern that culminates in the deployment of a CoinMiner

Researchers warn of attacks against poorly managed Linux SSH servers that mainly aim at installing DDoS bot and CoinMiner.

An attack campaign that installs XMRig Coinminer on Windows web servers that run on Apache has been discovered recently.

<div><p><a href="https://medium.com/@huntressofthreats/digging-into-the-shadows-a-comprehensive-guide-to-threat-hunting-for-coinminer-3936bbd8c625?source=rss------cybersecurity-5"><img src="https://cdn-images-1.medium.com/max/1104/1*ildhrOUagXd1dbLpRqp-HA.jpeg" width="1104" alt="1*ildhrOUagXd1dbLpRqp-HA.jpeg"></a></p><p>As the world embraces the digital era, cyber threats continue to evolve, with malicious actors finding innovative ways to exploit…</p><p><a href="https://medium.com/@huntressofthreats/digging-into-the-shadows-a-comprehensive-guide-to-threat-hunting-for-coinminer-3936bbd8c625?source=rss------cybersecurity-5">Continue reading on Medium »</a></p></div>

<p>Last week, we saw a supply-chain attack against the Ultralytics AI library on GitHub. A <a href="https://www.reversinglabs.com/blog/compromised-ultralytics-pypi-package-delivers-crypto-coinminer">quick summary</a>:</p> <blockquote><p>On December 4, a malicious version 8.3.41 of the popular AI library <i>ultralytics</i> ­&#8212;which has almost 60 million downloads&#8212;was published to the Python Package Index (PyPI) package repository. The package contained downloader code that was downloading the <i>XMRig</i> coinminer. The compromise of the project&#8217;s build environment was achieved by exploiting a known and previously reported GitHub Actions script injection.</p></blockquote> <p>Lots more details at that link. Also ...</p>

AhnLab SEcurity intelligence Center (ASEC) is monitoring attacks targeting poorly managed Linux servers by utilizing multiple honeypots. One of the most common honeypots is the SSH service using weak credentials, and a large number of DDoS and CoinMiner threat actors are attacking this service. ASEC has recently identified a case of an attack that installs […] Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any fl...

Explore the dangers of Outlaw Linux malware, a persistent coinminer that combines automated execution with manual oversight.

Explore the dangers of Outlaw Linux malware, a persistent coinminer that combines automated execution with manual oversight.

Cybercriminals continue to exploit USB drives as infection vectors, with recent campaigns delivering sophisticated CoinMiner malware.

CoinMiner spreads via USB drives in South Korea, using fake shortcuts to install XMRig and secretly mine Monero on infected systems.