Thursday, April 17, 2025
HomeMalwarePowerGhost Malware Remotely Attack Corporate Network Servers & Workstations using EternalBlue Exploit

PowerGhost Malware Remotely Attack Corporate Network Servers & Workstations using EternalBlue Exploit

Published on

SIEM as a Service

Follow Us on Google News

Newly discovered  PowerGhost Malware Spreading across corporate networks that infecting both servers and workstations to illegally mining the crypt-currency and Perform DDoS Attacks.

Cybercriminals targeting large number corporate networks to mining the cryptocurrency and DDoS attack to generate huge profits.

Enterprise Networks should choose the best DDoS Attack prevention services to ensure the DDoS attack protection and prevent their network.

- Advertisement - Google News

In this case, attackers using fileless malware techniques to maintain the persistence and it used to bypass the antivirus detection and leverage the corporate vulnerabilities using known exploits such as Eternalblue.

PowerGhost malware miner is encountered most often in India, Brazil, Columbia, and Turkey and infected a large number of corporate companies local area networks.

PowerGhost Malware Infection Techniques

Initially, victims affected using remote administration tools or remotely using exploits and the PowerShell scripts will download the miner’s and immediately launches it into the hard drive.

PowerGhost act as an Obfuscated PowerShell scripts that contains a number of core modules such as miners, libraries for mining operations and PE file injection for Eternalblue exploit.

  • Miner – mimikatz
  • libraries – msvcp120.dll and msvcr120.dll
  • PE injection and shellcode

Scripts performing the several stages and it is capable of self-update its module that keeps checking its C2 server, if it found any, then it automatically update itself.

According to kaspersky , With the help of mimikatz, the miner obtains the user account credentials from the current machine, uses them to log on and attempts to propagate across the local network by launching a copy of itself via WMI and download the miner body from C2 server.

PowerGhost try to spread across the local network using the EternalBlue exploit (MS17-010, CVE-2017-0144).

Later it escalates its privileges when it landing into the new system with the 32- or 64-bit exploits for MS16-032, MS15-051, and CVE-2018-8120. Finally, the script launches the miner by loading a PE file via reflective PE injection.

Researchers also found a tool for conducting DDoS attacks in one of the PowerGhost version to make extra money along with the mining operation profit.

Protect your corporate networks from future attacks and also Check your Companies DDOS Attack Downtime Cost.

Indicators of compromise

MD5:

AEEB46A88C9A37FA54CA2B64AE17F248
4FE2DE6FBB278E56C23E90432F21F6C8
71404815F6A0171A29DE46846E78A079
81E214A4120A4017809F5E7713B7EAC8

Also Read

Hackers Mined Monero Worth $90000 by Pushing 17 Malicious Images to a Docker Hub

Hackers using ETERNALBLUE Exploit in Cryptocurrency Mining Malware to Mine Monero using Vulnerable Windows Machines

The Pirate Bay Mining Monero Cryptocurrency – Beware & Here the Best TPB Alternative 2018

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Ransomware Attacks Surge 126%, Targeting Consumer Goods and Services Sector

The cybersecurity landscape witnessed a dramatic escalation in ransomware attacks, marking a concerning trend...

CrazyHunter Hacker Group Exploits Open-Source GitHub Tools to Target Organizations

A relatively new ransomware outfit known as CrazyHunter has emerged as a significant threat,...

Threat Actors Leverage Cascading Shadows Attack Chain to Evade Detection and Hinder Analysis

A sophisticated multi-layered phishing campaign was uncovered, employing a complex attack chain known as...

Microsoft Vulnerabilities Reach Record High with Over 1,300 Reported in 2024

The 12th Edition of the Microsoft Vulnerabilities Report has revealed a significant surge in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

LummaStealer Exploits Windows Utility to Run Remote Code Disguised as .mp4 File

The Cybereason Global Security Operations Center (GSOC) has shed light on the sophisticated tactics...

Gamaredon’s PteroLNK VBScript Malware Infrastructure and TTPs Uncovered by Researchers

Researchers have unearthed details of the Pterodo malware family, notably the PteroLNK variant used...

Agent Tesla Malware Uses Multi-Stage Attacks with PowerShell Scripts

Researchers from Palo Alto Networks have uncovered a series of malicious spam campaigns leveraging...