Friday, December 1, 2023

Cryptocurrency Miners Back – Lemon Duck Attacking Government, Retail, and Technology Sectors

The Cybersecurity research firm Cisco Talos has recently detected an activity that are linked with the cryptocurrency botnet. The experts claimed that these attacks are targetting different businesses within sectors like the government, retail, and technology.

The attacker uses various techniques to spread the malware all over the network, just as sending affected RTF files by using email, psexec, WMI, and SMB exploits. Moreover, these files also contain the infamous Eternal Blue and SMBGhost threats that affect the Windows 10 machines. 

Some variants also support RDP brute-forcing, and experts have identified that the attackers also use tools such as Mimikatz, as it helps the botnet increase the number of systems participating in its opening pool.

Lemon Duck Malware

Lemon Duck is a botnet that has automatic spreading capabilities. Its concluding payload is a modification of the Monero cryptocurrency mining software XMR.

Lemon Duck is one of the most complicated mining botnets with various impressive methods and techniques to cover up all its operations.

According to the reports, the security experts have recently seen a recovery in the number of DNS requests that are connected with its command and control and mining servers.

That’s why the security experts have decided to take a close look at its functionality by prioritizing previously less documented modules like the Linux branch and C# modules that are loaded by the specific PowerShell component.

What’s new?

This threat has been active since the end of December 2018, and there has been an apparent increase in its activity at the end of August 2020.

Infection vectors

The cybersecurity team, Cisco Talos, has affirmed that they had recorded 12 independent infection vectors ranging from standard copying over SMB shares and tried to use the vulnerabilities in Redis and the YARN Hadoop resource manager and job scheduler. 

Not only this, but the Talos experts have also noticed a huge increase in the number of DNS requests connected with Lemon Duck C2 and mining servers, and it has been done at the end of August 2020.

GPUs used by Lemon Duck for mining

  • GTX
  • AMD

Modular Functionalities

In Lemon Duck, the modules that are included are the primary loader; it checks the level of user privileges and all the elements that are relevant for mining, like the type of the accessible graphic card. If these GPUs are not identified, then the loader will get download and run the commodity XMRig CPU-based mining script.

Moreover, other modules are included in the main spreading module, a Python-based module packaged using a Pyinstaller, and a killer module designed to impair known competing mining botnets.

Open-source PowerShell projects code included in Lemon Duck

  • Invoke-TheHash by Kevin Robertson
  • Invoke-EternalBlue PowerShell EternalBlue port
  • BlueKeep RCE exploit (CVE- 2019-0708) PowerShell port
  • Powersploit’s reflective loader by Matt Graeber
  • Modified Invoke-Mimikatz PowerShell module

Apart from this, the threat actors behind Lemon Duck want to make sure that their operation must be profitable. That’s why the Lemon Duck has checked all the infected machines for other known crypto miners and shuts them down accordingly.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

CoronaVirus Cyber Attack Panic – Threat Actors Targets Victims Worldwide

Chinese APT Hackers Exploit MS Word Bug to Drop Malware Via Weaponized Coronavirus Lure Documents

How Can The Coronavirus (COVID-19) Disrupt Cybersecurity Operations?


Latest articles

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

Zyxel Command Injection Flaws Let Attackers Run OS Commands

Three Command injection vulnerabilities have been discovered in Zyxel NAS (Network Attached Storage) products,...

North Korean Hackers Attacking macOS Using Weaponized Documents

Hackers often use weaponized documents to exploit vulnerabilities in software, which enables the execution...

Most Popular Websites Still Allow Users To Have Weak Passwords

The latest analysis shows that tens of millions of people are creating weak passwords...

Chrome Zero-Day Vulnerability That Exploited In The Wild

Google has fixed the sixth Chrome zero-day bug that was exploited in the wild this...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles