This new botnet has recruited an army of Windows devices

  • Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Welcome to our Community
Wanting to join the rest of our members? Feel free to sign up today.
Sign up

PCHF IT Feeds

PCHF Tech News
PCHF Bot
Jan 10, 2015
32,384
20
pchelpforum.net
A new botnet is exploiting close to a dozen high and critical-severity vulnerabilities in Windows systems to turn them into cryptomining clients as well as to launch DDoS attacks.

The malware behind the botnet has been given the name Satan DDoS though security researchers have taken to referring to its as Lucifer in order to avoid confusion with the Satan ransomware.

Palo Alto Networks' Unit 42 began looking into the botnet after the company's researchers discovered it while following multiple incidents involving the exploitation of a critical vulnerability in a component of the Laravel web framework which can lead to remote code execution.


At first the Lucifer malware was believed to be used to mine the cryptocurrency Monero. However, it later become apparent that the malware also contains a DDoS component as well as a self-spreading mechanism that uses severe vulnerabilities and brute-forcing to its advantage.

Lucifer malware


In a blog post, Unit 42 provided further details on just how powerful the capabilities of the Lucifer malware are, saying:

“Lucifer is quite powerful in its capabilities. Not only is it capable of dropping XMRig for cryptojacking Monero, it’s also capable of command and control (C2) operation and self-propagation through the exploitation of multiple vulnerabilities and credential brute-forcing. Additionally, it drops and runs EternalBlue, EternalRomance, and DoublePulsar backdoor against vulnerable targets for intranet infections.”

The operators behind Lucifer have weaponized exploits for 11 different vulnerabilities which have all since been patched. However, cybercriminals often leverage older vulnerabilities to prey on users who have yet to patch their systems.

The latest version of the botnet malware also includes anti-analysis protection which allows it to check the user and computer name of an infected machine before carrying out its operations. If any names are found that correspond with analysis environments, the malware stops.

To protect against Lucifer, businesses and individuals should keep their software updated with the latest patches and use strong passwords.


Via BleepingComputer

Continue reading...