Fileless PowerGhost cryptocurrency miner leverages EternalBlue exploit to spread
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0144 | Remote Code Execution in Microsoft SMBv1 (EternalBlue) affecting Windows and Siemens devices CVE-2017-0144 is a remote code execution flaw in the SMBv1 server component of Microsoft Windows, commonly known as EternalBlue, and one of the SMB flaws fixed by Microsoft in the March 2017 MS17-010 bulletin. An attacker who can reach the SMB service over the network sends specially crafted packets that trigger memory corruption in the SMBv1 implementation, gaining the ability to execute arbitrary code on the target without user interaction. Successful exploitation yields full system compromise and has been heavily weaponized for wormable spread and ransomware delivery, notably via the leaked NSA exploit and in the WannaCry/NotPetya-era outbreaks, and the flaw has repeatedly been bundled into botnets and ransomware tooling since. Anyone running unpatched Windows Vista SP2 through Windows 10 1607 / Windows Server 2016 with SMBv1 enabled is affected, as are Siemens medical and laboratory devices (ACUSON ultrasound, syngo SC2000, Tissue Preparation System, VERSANT kPCR systems) whose firmware depends on SMBv1. Exploitation is actively ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with known ransomware use, carries a 99.2% EPSS exploitation probability (100th percentile), and multiple public exploits and PoCs are available. Do: Apply the Microsoft MS17-010 (March 2017) security updates on every listed Windows version and the corresponding Siemens firmware updates for ACUSON, syngo SC2000, Tissue Preparation System, and VERSANT kPCR devices, per CISA's required action to apply vendor updates. Where patching is not yet possible, disable SMBv1 or block inbound TCP 445 (and UDP 137/138) at network boundaries and isolate legacy/medical systems from the internet. Sweep exposed and legacy hosts for compromise indicators, including DOUBLEPULSAR implants delivered over SMB, as public tooling for detecting and neutralizing this implant is available. | 8.8 | 99% | KEV ransomware PoC ×6 |
| massorder of hundreds of thousands of internet-exposed SMB endpoints, and millions of unpatched Windows systems when internal enterprise and medical-device… | |
| CVE-2018-8120 | Local Privilege Escalation in Microsoft Win32k (Windows 7 / Server 2008) CVE-2018-8120 is an elevation of privilege flaw in the Microsoft Windows Win32k kernel component, which fails to properly handle objects in memory. A local attacker who already has the ability to run code with low privileges on the machine must execute a specially crafted application that triggers the faulty object handling, allowing code to run in kernel mode. Successful exploitation yields elevated (SYSTEM-level) privileges and full control of the host, and it is commonly chained with a remote code execution or browser exploit, or used by malware — including ransomware — to deepen a compromise. Only systems running Windows 7, Windows Server 2008, or Windows Server 2008 R2 with unpatched Win32k are affected. The bug was exploited as a zero-day (reportedly by the ScarCruft APT group) before being fixed in May 2018 Patch Tuesday, a public PoC is available, and it was added to CISA's Known Exploited Vulnerabilities catalog in March 2022 with known ransomware use. Do: Apply Microsoft's May 2018 security updates or later cumulative updates for Windows 7, Windows Server 2008, and Windows Server 2008 R2, prioritizing this KEV-listed flaw per the CISA required action. Systems beyond end of support that are not receiving Extended Security Updates should be migrated to a supported Windows version or isolated, since they remain permanently exposed to known APT and ransomware tooling. Review hosts for signs of local privilege escalation and ensure any RCE entry vector (browser, file format, or service exploit) is also patched, as this bug is typically used to escalate an initial foothold. | 7.0 | 73% | KEV ransomware PoC |
| mass≈ hundreds of millions of Windows 7 desktops plus widespread Windows Server 2008/2008 R2 deployments worldwide |
Full article507 words · extracted from securityaffairs.com · click to collapse
Security experts from Kaspersky Lab have spotted a new cryptocurrency miner dubbed PowerGhost that can spread leveraging a fileless infection technique.
The PowerGhost miner targets large corporate networks, infecting both workstations and servers, it employing multiple fileless techniques to evade detection.
“The malware, which we dubbed PowerGhost, is capable of stealthily establishing itself in a system and spreading across large corporate networks infecting both workstations and servers.” reads the analysis published by Kaspersky.
“This type of hidden consolidation is typical of miners: the more machines that get infected and the longer they remain that way, the greater the attacker’s profits. Therefore, it’s not uncommon to see clean software being infected with a miner; the popularity of the legitimate software serves to promote the malware’s proliferation.”
The PowerGhost leverages the NSA-linked EternalBlue exploit to spread, it is obfuscated PowerShell script containing malware’s core code, along with many other add-on modules such as the miner, miner libraries, the Mimikatz post-exploitation too, a module for reflective PE injection, and a shellcode for the EternalBlue exploit.
The victim system is infected remotely using exploits or remote administration tools (Windows Management Instrumentation), experts discovered that during the infection phase a one-line PowerShell script is executed to drop the core of the miner component and execute it, the entire process in the memory of the system.
The first thing that the malware does it to check the command and control (C&C) server and, if a new version is available, it downloads and executes it.
Then the malware uses the Mimikatz tool to get the user account credentials from the machine and use it to attempt lateral movements inside the target network.
“Propagation.With the help of mimikatz, the miner obtains the user account credentials from the current machine, uses them to log on and attempts to propagate across the local network by launching a copy of itself via WMI. By “a copy of itself” here and below we mean the one-line script that downloads the miner’s body from the C&C.” continues the analysis.
“PowerGhost also tries to spread across the local network using the now-notorious EternalBlue exploit (CVE-2017-0144).”
Once infected a machine, the PowerGhost attempts to escalate privileges by using various exploits such as the one for CVE-2018-8120.
In order to establish a foothold in the infected system, the PowerGhost saves all the modules as properties of a WMI class, while miner main body is saved as a one-line PowerShell script in a WMI subscription that activates every 90 minutes.
The script executes the miner by loading a PE file via reflective PE injection.
Most of the PowerGhost infections were observed in India, Brazil, Columbia, and Turkey.
Experts discovered also a PowerGhost version that implements DDoS capability, a circumstance that leads Kaspersky into believing that authors attempted to create a DDoS-for-hire service.
Further details, including Indicators of Compromise (IoCs) are reported in the analysis published by Kaspersky.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – PowerGhost, cryptocurrency miner)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/74921/malware/powerghost-crypto-miner.html