silversurfer

Level 50
Verified
Trusted
Content Creator
Malware Hunter
The new miner malware strain dubbed Norman by the Varonis Security Research team was discovered while actively mining for Monero using the computing resources of the infected workstations and servers as directed by its operators.

All infected hosts on the network were very easily detected by the use of DuckDNS which is a dynamic DNS service designed to help users create custom domain names easier.

According to the researchers who found this new cryptomining malware, "most of the malware from this case relied on DuckDNS for command and control (C&C) communications, to pull configuration settings or send updates."

Besides multiple miner malware samples among which Norman stood out as not having been seen before in the wild, Varonis' research team also discovered several password dumping tools and a hidden PHP shell, with some of them having infected the systems a few years earlier.
Read more below:
 
Last edited: