Microsoft reported about activity of the LemonDuck malware

Vladimir Krasnogolovy — Tue, 27 Jul 2021 16:15:13 +0000

Microsoft researchers have published a detailed analysis of the LemonDuck mining malware and reported that cross-platform malware continues to improve.

LemonDuck is capable of attacking Windows and Linux, exploits old vulnerabilities and uses various distribution mechanisms to improve the effectiveness of its campaigns.

LemonDuck, an actively updated and resilient malware known for its botnets and cryptocurrency mining, has followed a well-known path, exhibiting more sophisticated behavior and expanding its operations. Today LemonDuck not only uses resources [victims] for its bots and mining, but also steals credentials, disables security mechanisms, spreads via email, exhibits lateral movement, and ultimately delivers [to the infected system] other malicious tools controlled by man.Microsoft told.

LemonDuck activity was first discovered in China in May 2019. Later, in 2020, malware began to use decoys related to COVID-19 for its attacks, and most recently exploited ProxyLogon vulnerabilities fixed in Microsoft Exchange to access unprotected systems.

In general, LemonDuck looks for devices vulnerable to issues such as CVE-2017-0144 (EternalBlue), CVE-2017-8464 (LNK RCE), CVE-2019-0708 (BlueKeep), CVE-2020-0796 (SMBGhost), CVE-2021-26855 (ProxyLogon), CVE-2021-26857 (ProxyLogon), CVE-2021-26858 (ProxyLogon) and CVE-2021-27065 (ProxyLogon).

One of the hallmarks of LemonDuck is the malware’s ability to remove “other attackers from a compromised device, thus getting rid of competing malware and preventing new infections, as well as fixing vulnerabilities that were used to gain access.”

LemonDuck attacks typically targets the manufacturing sector and IoT, with the largest number of incidents reported in the US, Russia, China, Germany, UK, India, Korea, Canada, France, and Vietnam.

Microsoft also describes another LemonDuck-related campaign dubbed LemonCat in its report. Experts believe LemonCat is being used for other purposes and has been active since January 2021. In particular, LemonCat was used in attacks against vulnerable Microsoft Exchange servers, and these incidents led to the installation of a backdoor, theft of credentials and information, and the installation of the Ramnit Trojan.

While the LemonCat infrastructure is being used for more dangerous campaigns, it does not mitigate the risk of malware infection associated with the LemonDuck infrastructure. Microsoft said.

Let me remind you that we talked about LemonDuck malware operators attack IoT vendors.

The post Microsoft reported about activity of the LemonDuck malware appeared first on Gridinsoft Blog.

CERT launched Twitter bot that comes up with names for vulnerabilities

Vladimir Krasnogolovy — Mon, 02 Nov 2020 23:26:36 +0000

Specialists from the CERT Coordination Center (CERT/CC) have launched a special Twitter bot, Vulnonym, which will “invent” random and maximally neutral names for vulnerabilities that have received CVE identifiers.

This idea was born out of endless discussions about “should vulnerabilities have names?”

For many decades, MITER has been assigning CVE identifiers to vulnerabilities in the standard format CVE-[YEAR] – [NUMBER], for example CVE-2019-0708. These CVEs are used by security software to identify bugs, track and monitor problems for statistical purposes, but humans actually use CVEs.

Over the years, cybersecurity specialists have realized that their work on discovering vulnerabilities can get lost in a constant stream of CVEs that are difficult to remember. Therefore, companies and researchers began to name their vulnerabilities in order to step out from the crowd and be remembered. The most famous examples of this are Specter, Meltdown, Dirty Cow, Zerologon, Heartbleed, BlueKeep, SIGRed, BLURTooth, DejaBlue and Stagefright vulnerabilities.

CERT experts believe that over time, this practice has moved to the stage of intimidation and turned into a marketing ploy to attract attention.

Because of this, some serious bugs remained almost unnoticed, as they did not receive high-profile titles, while almost non-dangerous errors received a lot of attention from the media just because they had big names, their own sites, logos, and sometimes even theme songs.told in CERT.

The situation sometimes really reaches the point of absurdity. For example, last year a vulnerability found by Cisco was named using three emojis and is also known as Thrangrycat (“Three angry cats“).

In an attempt to mitigate the situation, CERT experts created Vulnonym, which will give bugs neutral codenames, consisting of two words in the adjective-noun format.

Not every vulnerability with a name is a serious threat, although some researchers want you to think so. We are suggesting that vulnerabilities should be named, in fact, we even encourage it! Our goal is to create neutral names that allow people to remember vulnerabilities, but not focus on how dire (or harmless) the particular problem is.writes CERT/CC member Lee Metcalfe

Metcalfe explains that people just need easy-to-remember names to describe bugs, because “people are not good at remembering numbers,” such as those used as CVE identifiers. So, a person will easily remember google.com, but not the IP address that this site is hosted on.

Let me remind you that experts of NortonLifeLock developed a free bot detection tool on Twitter.

The post CERT launched Twitter bot that comes up with names for vulnerabilities appeared first on Gridinsoft Blog.

BlueKeep Archives – Gridinsoft Blog

Microsoft reported about activity of the LemonDuck malware

Microsoft researchers have published a detailed analysis of the LemonDuck mining malware and reported that cross-platform malware continues to improve.

CERT launched Twitter bot that comes up with names for vulnerabilities

Specialists from the CERT Coordination Center (CERT/CC) have launched a special Twitter bot, Vulnonym, which will “invent” random and maximally neutral names for vulnerabilities that have received CVE identifiers.