1300 551 486

Blog

New Powerful Malware Is Targeting Windows-Based Machines

Share on facebook
Share
Share on twitter
Tweet
Share on linkedin
Share

Researchers have discovered a devilishly clever new stain of malware currently in use by hackers around the world. The new strain is appropriately called “Lucifer,” and has been making life quite difficult for IT professionals managing Windows environments.

The malware exploits critical vulnerabilities in Windows-based systems to launch DDoS attacks and install cryptojacking code.

The latest version (2.0) of the code was discovered by researchers Durgesh Sangvikar, Zhibin Zhang, Chris Navarrete, and Ken Hsu, on May 29, 2020. They discovered it while investigating the exploit of CVE-2019-9081, which is a deserialization bug in Laravel Framework that can be used to conduct RCE (Remote Code Execution) attacks.

Their research revealed that CVE-2019-9081 is just one of many critical security flaws Lucifer exploits, including:

  • CVE-2014-6287
  • CVE-2018-1000861
  • CVE-2017-10271
  • CVE-2018-20062
  • CVE-2018-7600
  • CVE-2017-9791
  • CVE-2019-9081
  • CVE-2017-0144
  • CVE-2017-0145
  • CVE-2017-8464

Few malware strains incorporate code designed to exploit so many different security flaws, which makes Lucifer a serious threat indeed.

If there’s a silver lining to be found, it is in the fact that all of these flaws have already been addressed via patches. So it comes down to making sure your software is up to date and running the latest and greatest security patches. The researchers who discovered it say that there are ongoing campaigns that are currently wreaking havoc on un-patched systems and urge all system admins to make sure the software they’re running is patched as soon as possible.

In practice, Lucifer 2.0 works by scanning for open TCP ports 135 (RPC) and 1433 (MSSQL). When it finds a potential target, it will use credential-stuffing attacks to gain access to the targeted system. Once it gains a foothold, it installs XMRig, which is a program used to covertly mine Monero (XMR) cryptocurrency. Additionally, the malware connects to a command and control server where it can receive additional instructions.

As we said, it’s a serious piece of work and not to be taken lightly.

Used with permission from Article Aggregator

FREE BUSINESS GUIDE

 

Don’t even think about calling a computer consultant before you read this!

If you are a small to medium business owner looking for computer support, then it’s critical that you read this business guide about IT services: This Business Advisory Guide Will Arm You With 18 Revealing Questions You Should Ask Any Computer Consultant Before Giving Them Access To Your Company’s Network.

Important! We hate spam as much (or more!) than you and promise to NEVER rent, share, or abuse your e-mail address and contact information in any way.

“Be Your Own Best Defense Against Cybercrime”

Sign Me Up For The Free Assessment

Book My Brief 10-15 Minute Initial Consultation