CrowdStrike Warns of Phishing Scam Targeting Job Seekers with XMRig Cryptominer
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-49113 | Unauthenticated LDAP Denial-of-Service in Microsoft Windows CVE-2024-49113 is an unauthenticated denial-of-service vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) implementation, caused by an out-of-bounds read (CWE-125) and rated 7.5 (high) with network reachability, no privileges and no user interaction required. An attacker who can send crafted LDAP traffic to an affected Windows system can trigger the flaw, crashing the LSASS process; on domain controllers this crashes LSASS and reboots the server, taking authentication and directory services offline. Follow-up research ("Win-DDoS") also showed that internet-exposed domain controllers can be abused as DDoS amplification/reflection agents, extending the impact beyond a single-host outage. Affected systems span essentially all supported Windows clients and servers, from Windows 10 1507 and Windows Server 2008 through Windows 11 24H2 and Windows Server 2022. A public proof-of-concept exploit ("LDAPNightmare") demonstrating an LSASS crash and domain controller reboot has been widely reported; the flaw is not yet in CISA's KEV, but EPSS places it in the 100th percentile with an 83% probability of exploitation within 30 days. Do: Apply the January 2025 Microsoft security updates for CVE-2024-49113, prioritizing domain controllers and other internet-reachable Windows servers. Reduce exposure by not publishing LDAP (389/636) directly to the internet, restricting outbound LDAP referral traffic/egress from domain controllers, and monitoring for LSASS crashes and unexpected reboots. When validating with PoC tooling, use only trusted sources, as fake PoC repositories distributing infostealers and RATs have been reported targeting researchers. | 7.5 | 83% |
| massmass |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | github.com | tion stealer. The malicious GitHub repository in question – github[.]com/YoonJae-rep/CVE-2024-49113 (now taken down) – is said to |
Full article520 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 10, 2025Cryptomining / Malware
Cybersecurity company CrowdStrike is alerting of a phishing campaign that exploits its own branding to distribute a cryptocurrency miner that's disguised as an employee CRM application as part of a supposed recruitment process.
"The attack begins with a phishing email impersonating CrowdStrike recruitment, directing recipients to a malicious website," the company said. "Victims are prompted to download and run a fake application, which serves as a downloader for the cryptominer XMRig."
The Texas-based company said it discovered the malicious campaign on January 7, 2025, and that it's "aware of scams involving false offers of employment with CrowdStrike."
The phishing email lures recipients by claiming that they have been shortlisted for the next stage of the hiring process for a junior developer role, and that they need to join a call with the recruitment team by downloading a customer relationship management (CRM) tool provided in the embedded link.
The downloaded binary, once launched, performs a series of checks to evade detection and analysis prior to fetching the next-stage payloads.
These checks include detecting the presence of a debugger and scanning the list of running processes for malware analysis or virtualization software tools. They also ensure that the system has a certain number of active processes and the CPU has at least two cores.
Should the host satisfy all the criteria, an error message about a failed installation is displayed to the user, while covertly downloading the XMRig miner from GitHub and its corresponding configuration from another server ("93.115.172[.]41") in the background.
"The malware then runs the XMRig miner, using the command-line arguments inside the downloaded configuration text file," CrowdStrike said, adding the executable establishes persistence on the machine by adding a Windows batch script to the Start Menu Startup folder, which is responsible for launching the miner.
Fake LDAPNightmare PoC Targets Security Researchers
The development comes as Trend Micro revealed that a fake proof-of-concept (PoC) for a recently disclosed security flaw in Microsoft's Windows Lightweight Directory Access Protocol (LDAP) – CVE-2024-49113 (aka LDAPNightmare) – is being used to lure security researchers into downloading an information stealer.
The malicious GitHub repository in question – github[.]com/YoonJae-rep/CVE-2024-49113 (now taken down) – is said to be a fork of the original repository from SafeBreach Labs hosting the legitimate PoC.
The counterfeit repository, however, replaces the exploit-related files with a binary named "poc.exe" that, when run, drops a PowerShell script to create a scheduled task to execute a Base64-encoded script. The decoded script is then used to download another script from Pastebin.
The final-stage malware is a stealer that collects the machine's public IP address, system metadata, process list, directory lists, network IP addresses, network adapters, and installed updates.
"Although the tactic of using PoC lures as a vehicle for malware delivery is not new, this attack still poses significant concerns, especially since it capitalizes on a trending issue that could potentially affect a larger number of victims," security researcher Sarah Pearl Camiling said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/01/crowdstrike-warns-of-phishing-scam.html