Wednesday, May 22, 2024

Cryptocurrency Miners Back – Lemon Duck Attacking Government, Retail, and Technology Sectors

The Cybersecurity research firm Cisco Talos has recently detected an activity that are linked with the cryptocurrency botnet. The experts claimed that these attacks are targetting different businesses within sectors like the government, retail, and technology.

The attacker uses various techniques to spread the malware all over the network, just as sending affected RTF files by using email, psexec, WMI, and SMB exploits. Moreover, these files also contain the infamous Eternal Blue and SMBGhost threats that affect the Windows 10 machines. 

Some variants also support RDP brute-forcing, and experts have identified that the attackers also use tools such as Mimikatz, as it helps the botnet increase the number of systems participating in its opening pool.

Lemon Duck Malware

Lemon Duck is a botnet that has automatic spreading capabilities. Its concluding payload is a modification of the Monero cryptocurrency mining software XMR.

Lemon Duck is one of the most complicated mining botnets with various impressive methods and techniques to cover up all its operations.

According to the reports, the security experts have recently seen a recovery in the number of DNS requests that are connected with its command and control and mining servers.

That’s why the security experts have decided to take a close look at its functionality by prioritizing previously less documented modules like the Linux branch and C# modules that are loaded by the specific PowerShell component.

What’s new?

This threat has been active since the end of December 2018, and there has been an apparent increase in its activity at the end of August 2020.

Infection vectors

The cybersecurity team, Cisco Talos, has affirmed that they had recorded 12 independent infection vectors ranging from standard copying over SMB shares and tried to use the vulnerabilities in Redis and the YARN Hadoop resource manager and job scheduler. 

Not only this, but the Talos experts have also noticed a huge increase in the number of DNS requests connected with Lemon Duck C2 and mining servers, and it has been done at the end of August 2020.

GPUs used by Lemon Duck for mining

  • GTX
  • AMD

Modular Functionalities

In Lemon Duck, the modules that are included are the primary loader; it checks the level of user privileges and all the elements that are relevant for mining, like the type of the accessible graphic card. If these GPUs are not identified, then the loader will get download and run the commodity XMRig CPU-based mining script.

Moreover, other modules are included in the main spreading module, a Python-based module packaged using a Pyinstaller, and a killer module designed to impair known competing mining botnets.

Open-source PowerShell projects code included in Lemon Duck

  • Invoke-TheHash by Kevin Robertson
  • Invoke-EternalBlue PowerShell EternalBlue port
  • BlueKeep RCE exploit (CVE- 2019-0708) PowerShell port
  • Powersploit’s reflective loader by Matt Graeber
  • Modified Invoke-Mimikatz PowerShell module

Apart from this, the threat actors behind Lemon Duck want to make sure that their operation must be profitable. That’s why the Lemon Duck has checked all the infected machines for other known crypto miners and shuts them down accordingly.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

CoronaVirus Cyber Attack Panic – Threat Actors Targets Victims Worldwide

Chinese APT Hackers Exploit MS Word Bug to Drop Malware Via Weaponized Coronavirus Lure Documents

How Can The Coronavirus (COVID-19) Disrupt Cybersecurity Operations?


Latest articles

Cloud-Based Malware Attack Abusing Google Drive & Dropbox

A phishing email with a malicious zip attachment initiates the attack. The zip contains...

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...

DoppelGänger Attack: Malware Routed Via News Websites And Social Media

A Russian influence campaign, DoppelGänger, leverages fake news websites (typosquatted and independent) to spread...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles