During the Great GPU Shortage of Yesteryear, cryptocurrency mining was all the rage. This also gave way to a class of ‘cryptojacking’ malware that would attempt to pilfer computing resources from an infected PC and use them to most often mine Monero. That has not been a big concern in a long while. However, security researchers at Unit 42 have discovered a new self-propagating malware strain that is a variant of old cryptojacking code.
The researchers have dubbed it “Lucifer,” noting that the malware’s author(s) named it “Satan DDoS,” which some people might confuse with the similarly named “Satan Ransomware.”
No matter what you want to call it, the researchers say it is “quite powerful in its capabilities,” which extend beyond unauthorized cryptocurrency mining. It can also facilitate distributed denial of service (DDoS) attacks and spread through computer networks using a range of exploits that were developed by and stolen from the US National Security Agency (like EternalBlue).
Attacks have come in waves. The first one ended on June 10, 2020, but then a second wave kicked off the next day with an upgraded version that is “wreaking havoc.” This second campaign is ongoing.
Enterprise organizations are likely most at risk, in part because they do not always stay up to date with security patches. However, Lucifer exploits a range of vulnerabilities that also affect home PCs.
“While the vulnerabilities abused and attack tactics leveraged by this malware are nothing original, they once again deliver a message to all organizations, reminding them why it’s utterly important to keep systems up-to-date whenever possible, eliminate weak credentials, and have a layer of defenses for assurance,” the researchers say.
The best line of defense against Lucifer is to ensure that Windows is fully patched with the latest updates. And the second line of defense is to use a strong password for your Windows login (and any account, really). That’s because Lucifer attempts to brute-force its way into Windows systems, meaning it bombards PCs with commonly used login usernames (like administrator) and passwords (like 123123).
Thanks, ThreatPost
