Lemon_Duck cryptomining malware evolves to target Linux devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-8570 | Remote Code Execution in Microsoft Office via Malicious PPSX Files (CVE-2017-8570) CVE-2017-8570 is a remote code execution vulnerability in Microsoft Office caused by improper handling of embedded OLE objects (composite monikers) in memory, and it is tracked separately from the related CVE-2017-0243. An attacker triggers it by embedding a crafted moniker object in a document, most commonly a PowerPoint .ppsx slide-show file, and persuading a user to open it; the CVSS vector confirms user interaction is required. Successful exploitation lets the attacker run arbitrary code with the victim's privileges, enabling malware delivery, data theft, and follow-on activity. Any user or organization running affected Office builds that open untrusted documents is in scope, and public reporting ties the bug to high-volume maldoc toolkits (e.g., EtterSilent, ThreadKit) and targeted attacks, including one against Ukrainian organizations. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2022-02-25, EPSS puts the 30-day exploitation probability at 89.9% (100th percentile), and public PoCs exist. Do: Apply Microsoft's June 2017 (or later) security updates to all Office installations and audit the estate for outdated builds, since CISA KEV and EPSS data show this bug is still exploited years after the patch. As an interim mitigation, block or sandbox .ppsx (PowerPoint Show) email attachments, which are the primary delivery vector, and warn users about Office files triggering embedded object content. Prioritize remediation per CISA's KEV required action: apply updates per vendor instructions. | 7.8 | 90% | KEV PoC ×2 |
| masshundreds of millions of users potentially affected (Office install base exceeds 1 billion; practical exposure limited to systems not updated since mid-2017) | |
| CVE-2020-0796 | Unauthenticated RCE in Microsoft SMBv3 (SMBGhost) CVE-2020-0796 ('SMBGhost') is a memory-corruption (CWE-119) flaw in Microsoft's Server Message Block 3.1.1 (SMBv3) implementation, in which certain crafted requests — notably malformed compressed SMBv3 messages — can corrupt memory on the target. An unauthenticated remote attacker can trigger it by sending specially crafted SMBv3 packets directly to any SMB-enabled host, with no credentials or user interaction required. Successful exploitation yields arbitrary code execution on the target server or client, giving the attacker full control of the host, and the flaw was widely characterized as wormable because a compromised host can then attack others. Any Windows system running SMBv3 is affected — SMBv3 is enabled by default on modern Windows 10 and Windows Server builds, with Windows 10 versions 1903/1909 and Windows Server 2019/versions 1903/1909 identified in Microsoft's advisory. Exploitation is confirmed in the wild: the CVE is in CISA KEV (added 2022-02-10) with known ransomware use, EPSS assigns a 99.8% probability of exploitation within 30 days (100th percentile), and no public PoC is listed in the source data. Do: Apply Microsoft's updates per vendor instructions immediately, prioritizing Windows 10 1903/1909 and Windows Server 2019/1903/1909 hosts and anything with SMB (TCP 445) reachable by untrusted networks. Until patched, disable SMBv3 compression per Microsoft's mitigation guidance (setting DisableCompression=1 under LanmanServer) and restrict inbound TCP 445 to trusted sources. Given confirmed ransomware use, hunt for post-exploitation activity on unpatched hosts. | 10.0 | 100% | KEV ransomware PoC ×2 |
| masstens of millions of Windows hosts with SMBv3 enabled; on the order of 1M+ hosts with SMB (TCP 445) exposed to the internet per public scans |
Full article483 words · extracted from securityaffairs.com · click to collapse
A new variant of the infamous Lemon_Duck cryptomining malware has been updated to targets Linux devices.
Security researchers from Sophos have spotted a new variant of the Lemon_Duck cryptomining malware that has been updated to compromise Linux machines via SSH brute force attacks. The new variant also exploits SMBGhost bug in Windows systems, and is also able to target servers running Redis and Hadoop instances.
The Lemon_Duck cryptomining malware was first spotted in June 2019 by researchers from Trend Micro while targeting enterprise networks. The threat was gaining access over the MS SQL service via brute-force attacks and leveraging the EternalBlue exploit.
Upon infecting a device, the malware delivers an XMRig Monero (XMR) miner.
The malware is being distributed via large-scale COVID-19-themed spam campaigns, the messages use an RTF exploit targeting the CVE-2017-8570 Microsoft Office RCE to deliver the malicious payload.
The authors of the Lemon_Duck cryptomining malware have also added a module that exploits the SMBGhost (CVE-2020-0796) Windows SMBv3 Client/Server RCE.
Experts noticed that the threat actors exploited the CVE-2020-0796 flaw to collect information on compromised machines instead of running arbitrary code on the vulnerable systems.
It is interesting to note that the attackers between early June and August, disabled the EternalBlue and Mimikatz modules, likely to measure the effectiveness of the SMBGhost’s module.
Lemon_Duck miner uses a port scanning module that searches for Internet-connected Linux systems listening on the 22 TCP port used for SSH Remote Login, then launches SSH brute force attacks.
“This aspect of the campaign expands the mining operation to support computers running Linux. The brute-force module performs port scanning to find machines listening on port 22/tcp (SSH Remote Login). When it finds them, it launches an SSH brute force attack on these machines, with the username root and a hardcoded list of passwords.” reads the post published by Sophos. “If the attack is successful, the attackers download and execute malicious shellcode.”
Then the Lemon_Duck malware attempts to gain persistence by adding a cron job and collects SSH authentication credentials from the /.ssh/known_hosts file in the attempt to infect more Linux devices across the network.
Upon infection, the Lemon_Duck attackers attempt to disable SMBv3 compression through the registry and block the standard SMB network ports of 445 & 135 to prevent other threat actors from exploiting the same vulnerability.
The authors of Lemon_Duck have also added the support for scanning for and compromising servers running Redis (REmote DIctionary Server) in-memory, distributed databases and Hadoop clusters managed using YARN (Yet Another Resource Negotiator).
“The Lemon Duck cryptominer is one of the more advanced types of cryptojacker payloads we’ve seen,” concludes Sophos.
“Its creators continuously update the code with new threat vectors and obfuscation techniques to evade detection, and the miner itself is ‘fileless,’ meaning it remains memory resident and leaves no trace of itself on the victim’s filesystem.”
(SecurityAffairs – hacking, Lemon_Duck)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/107626/malware/lemon_duck-target-linux.html