Attacks on Cryptocurrency Businesses are Booming Again

About the attacks

• the Prometei botnet has been observed exploiting Exchange vulnerabilities and installing Monero miner. It used an open-source Monero mining software, SearchIndexer[.]exe.
• Another cryptocurrency-stealing malware HackBoss was distributed through Telegram. The malware is believed to have stolen over $560,000 from the victims so far.
• The Lazarus APT group was observed to be running a campaign utilizing BTC Changer malware. The threat group has redesigned its JS sniffers to steal cryptocurrency.
• Last month, U.S. educational organizations were targeted by cybercriminals with the intent to compromise their networks for mining cryptocurrencies such as Monero, Litecoin, Bitcoin, and Ethereum.

Exploited vulnerabilities 

• A threat actor targeted Nagios XI software to exploit a remote command injection vulnerability (CVE-2021-25296), which affected Nagios XI version 5.7.5 in a cryptojacking attack.
• Last month, an ongoing cryptocurrency malware campaign targeted unpatched QNAP NAS devices. The campaign exploited two remote command execution flaws (CVE-2020-2506 and CVE-2020-2507).

Conclusion