Malware News This cryptocurrency mining malware also disables your security services

[LASER_oneXM]

Content source

https://www.zdnet.com/article/this-cryptocurrency-mining-malware-also-disables-your-security-services/

A year on from the vulnerabilities being leaked, attackers are still using leaked NSA tools to power new attacks - this time with the newly uncovered PyRoMine.

A new form of cryptocurrency mining malware uses a leaked NSA-exploit to spread itself to vulnerable Windows machines, while also disabling security software and leaving the infected computer open to future attacks.

The Python-based malicious Monero miner has been uncovered by researchers at security company Fortinet who've dubbed it PyRoMine. It first appeared this month and spreads using EternalRomance, a leaked NSA-exploit which takes advantage of what until a year ago had been an undisclosed SMB vulnerability to self-propagate through networks.

EternalRomance helped spread BadRabbit ransomware and is similar in many ways to EternalBlue, a second leaked NSA exploit which helped fuel WannaCry and NotPetya. Both exploits look for public-facing SMB ports, allowing them to deliver malware to networks.

Once the PyRoMine payload makes its way onto a machine, a malicious VBScript is downloaded which enables Remote Desktop Protocol (RDP) to enable propagation with the aid of adding a firewall rule that allows traffic on RDP port 3389.

In addition to this, the malware also stops Windows Updates and allows the transfer of unencrypted data.

Disabling security software allows the attackers to potentially deliver additional malware, should they eventually pivot away from the cryptocurrency miner, which is downloaded following the manipulation of RDP. The miner is registered as a service named "SmbAgentService" by the file "svchost.exe."

Once running on a system, the malicious miner will use the power of the machine to mine for Monero - specifically selected because it can be mined by ordinary computers and provides additional privacy to users.

 

[RoboMan]

Amazing share, thank you