This blog post provides an overview of the AT&T Alien Labs™ technical analysis of the common malicious implants used by threat actors targeting vulnerable Exim, Confluence, and WebLogic servers. Upon exploitation, malicious implants are deployed on the compromised machine. While most of the attacks described below are historical, we at Alien Labs are continuing to see new attacks, which can be further researched on the Alien Labs Open Threat Exchange™ (OTX).
The main goal of these malicious implants thus far has been mining Monero crypto-currency. Below, we have included a diagram of a typical attack vector for this cryptomining worm.
Installation
For our research, we analyzed the following sample (you can also see related pulses on this in OTX): f00258815853f767d70897db7263f740b161c39ee50c46c26ab247afb824459a.
First, the adversaries attempt exploitation. When they are successful and code execution is achieved,…
 |
Posted by: Fernando Dominguez |
The post AT&T Alien Labs analysis of an active cryptomining worm appeared first on Cybersecurity Insiders.
January 09, 2020 at 09:09PM
0 comments:
Post a Comment