New Norman Cryptominer Uses Dynamic DNS for C2 Communication

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/new-norman-cryptominer-uses-dynamic-dns-for-c2-communication/

The new miner malware strain dubbed Norman by the Varonis Security Research team was discovered while actively mining for Monero using the computing resources of the infected workstations and servers as directed by its operators.

All infected hosts on the network were very easily detected by the use of DuckDNS which is a dynamic DNS service designed to help users create custom domain names easier.

According to the researchers who found this new cryptomining malware, "most of the malware from this case relied on DuckDNS for command and control (C&C) communications, to pull configuration settings or send updates."

Besides multiple miner malware samples among which Norman stood out as not having been seen before in the wild, Varonis' research team also discovered several password dumping tools and a hidden PHP shell, with some of them having infected the systems a few years earlier.

Read more below:

New Norman Cryptominer Uses Dynamic DNS for C2 Communication

A new cryptominer malware that infected almost all the computers on a company's network within a year uses DuckDNS for command and control communications with its masters.

www.bleepingcomputer.com

Varonis Uncovers New Malware Strains and a Mysterious Web Shell During a Monero Crypto Jacking Investigation

The Varonis Security Research team recently investigated an ongoing cryptomining infection that had spread to nearly every device at a mid-size company. Analysis of the collected malware samples revealed a...

www.varonis.com