Search: “cryptomining”

157 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 265 Ransomware 144 Vulnerability 101 Threat actor 47 Exploit / PoC 39 Data breach 20 Phishing & fraud 11 Policy & legal 11 Industry 6 Research 5 Advisory 2 AI safety & security 2

SeverityAll critical 224 high 234 medium 157 low 33 info 5

Watchbog and the Importance of Patching

Cisco TalosSep 11, 16:10 UTC · Sep 11, 2019Vulnerability CVE-2018-1000861

Qualys at Infosecurity Europe 2019: Hear best practices from industry leaders

Help Net SecurityJun 3, 00:00 UTC · Jun 3, 2019Vulnerability

Mac crypto miner distributed via MacUpdate, other software download sites

Help Net SecurityJun 26, 21:20 UTC · Jun 26, 2018Malware

Many users reported in the past few weeks their Macs have been infected with a new Monero Miner

Security AffairsMay 24, 19:05 UTC · May 24, 2018Malware

Nigelthorn malware infected over 100,000 systems abusing Chrome extensions

Security AffairsMay 14, 06:55 UTC · May 14, 2018Malware

Attackers behind Cloudflare_solutions Keylogger are back, 2000 WordPress sites already infected

Security AffairsJan 28, 07:23 UTC · Jan 28, 2018Malware

The Russian pipeline giant Transneft infected with a Monero cryptocurrency miner

Security AffairsDec 17, 08:57 UTC · Dec 17, 2017Malware

New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.

Darktrace identified a new 64-bit ELF variant of the Chaos botnet targeting misconfigured cloud deployments, expanding beyond the malware's traditional focus on routers and edge devices. Captured in a deliberately misconfigured Hadoop honeypot instance, the intrusion began with an HTTP request creating an application that ran embedded shell commands to fetch the Chaos agent binary from pan.tenire[.]com, set chmod 777 permissions, execute it, and delete the artifact to reduce forensic traces. The restructured variant adds a SOCKS proxy feature letting compromised systems ferry attacker traffic, while removing SSH-based spread and router-exploit functions, suggesting monetization beyond crypto mining and DDoS-for-hire. Possible Chinese origin is suggested by language artifacts and infrastructure; the delivery domain was previously used in Silver Fox's Operation Silk Lure phishing campaign delivering ValleyRAT.

The Hacker NewsAug 18, 12:13 UTC · 29d agoMalware1

Analysis of Smoke Loader in New Tsunami Campaign

Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.

A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.