Kingminer Botnet Keeps up with the Times
The e-currency boom in late 2017 sparked a new type of “gold rush”, as cyber-criminals started racing to infect home computers and data centers with crypto-miners.
While digital currencies have fluctuated wildly since late 2017, cyber-criminals are still making money and investing in the development of mining malware. Such is the case with Kingminer, a piece of crypto-jacking malware that has been around since early 2018.
Kingminer has drawn its share of scrutiny, as it has been thoroughly researched by the cyber-security community. Recently, though, Bitdefender researchers picked up an attack involving several new sophisticated techniques, tactics and procedures to deliver malicious payloads.
This new whitepaper on Kingminer focuses on novel techniques such as:
- Initial access from SQL Server processes by brute-forcing accounts
- Initial execution from a kernel exploit, e.g., EternalBlue, the technique used by WannaCry
- DGA (Domain Generation Algorithm) for evading blacklists
- Use of tools like Mimikatz and PowerSploit
- File-less execution of the bot
- Various payloads delivered from the attacker’s server (XMRig, Kingminer)
A Red Team Perspective on the Device42 Asset Management Appliance
August 10, 2022
Vulnerabilities Identified in Wyze Cam IoT Device
March 29, 2022
New FluBot and TeaBot Global Malware Campaigns Discovered
January 26, 2022
Bitdefender Honeypots Signal Active Log4Shell 0-Day Attacks Underway; Patch Immediately
December 10, 2021
Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand
November 08, 2021
Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware
September 16, 2021