A crypto mining botnet called Lemon Duck is spreading through Windows 10 computers, infecting users through fake Covid-19 emails.
Since the end of August, cybersecurity researchers have identified increased activity on a crypto mining botnet called “Lemon Duck”.
The botnet has been around since December 2018, however a big jump in activity over the past six weeks suggests that the malware has infiltrated many more machines in order to harness their resources to mine the cryptocurrency Monero.
Research carried out by Cisco’s Talos Intelligence Group, suggests that Lemon Duck infections are unlikely to have been detected by end users, however power defenders such as network administrators are likely to have picked it up.
Crypto mining malware can cause physical damage to hardware since it leaches resources by running the CPU or GPU constantly in order to carry out the mining process. This will cause an increase in power consumption and heat generation which, in severe cases, could lead to a fire.
Windows 10 computers are targeted by the malware which exploits vulnerabilities in a number of Microsoft system services. The malware has been spread through email with a Covid-19 related subject and an infected file attached. Once the system has been infected it uses Outlook to automatically send itself to every contact in the affected user’s contacts list.
The spurious emails contain two malicious files, the first is an RTF document with the name readme.doc. This exploits a remote code execution vulnerability in Microsoft Office. The second file is called readme.zip which contains a script that downloads and runs the Lemon Duck loader.
Once installed, the sophisticated software terminates a number of Windows services and downloads other tools for stealth connections to the rest of the network. Lemon Duck has also been known to infect Linux systems, but Windows machines are the primary victims.
The malware mines Monero since it is anonymous by design and very easy to obfuscate. The researchers did not elaborate as to who was behind Lemon Duck though it has been linked to other crypto mining malware called “Beapy” which targeted East Asia in June 2019.
Last month, Coinbase wallet users were targeted by new Android malware designed to steal Google Authenticator codes.
Source: , CoinTelegraph
Articles listed with Cash Tech News as the author are either general information, or may have been imported from another website, to bring our readers a rich media experience that encompasses articles that we find interesting, as well as those curated by others.
The views and opinions expressed here are for informational purposes only, and should not be confused with professional financial advice. These opinions are solely those of the author and do not necessarily reflect the views of CashTechNews.com. Every investment and trade involves risk. You should conduct your own research, and contact your professional financial advisor before making any investment.
Corrections, feedback, and ideas should be submitted through the website contact form.