Story image

Monero cryptocurrency miner enslaves Windows Server 2003 systems in botnet

02 Oct 17

A malicious cryptocurrency miner is causing havoc in Windows web servers worldwide and those with unpatched systems are vulnerable to becoming part of a mining botnet.

ESET researchers report that the miner leverages a known vulnerability in Microsoft IIS 6.0 to covertly install the Monero cryptocurrency miner on unpatched servers.

Monero is an alternative cryptocurrency to Bitcoin. Since May 2017, cybercriminals have modified legitimate open source Monero mining software and installed it on the servers.

They then used it to create a botnet containing several hundred servers and mined more than AU$80,000 of Monero cryptocurrency.

While Microsoft has addressed the vulnerability CVE-2017-7269 in server updates, researchers say many servers remain outdated.

“As a significant number of systems are still vulnerable, users of Windows Server 2003 are strongly advised to apply the security update, KB3197835, and other critical patches as soon as possible,” comments Michal Poslušný, ESET malware analyst.

“It is a vulnerability in the WebDAV service that is part of Microsoft IIS version 6.0, the webserver in Windows Server 2003 R2,” researchers explain.

In 2015, Microsoft ended regular update support for Windows Server 2003, however it did release a patch for this vulnerability in June 2017. This was only after several malware authors spotted several critical vulnerabilities in its older systems, researchers explain.

However, automatic updated don’t always work and this impacts the ability to keep Windows Server 2003 up to date.

“If automatic updates fail, we encourage users to download and install the security update manually to avoid falling victim to malicious attacks,” Poslušný continues.

The miner is also an example of how minimal skill levels and low operating costs can create functioning malware – in this instance, it was a combination of genuine software manipulation and unpatched systems that created the perfect environment for the Monero miner.

Researcher Peter Kálnai says there are many reasons why Monero is an attractive cryptocurrency for mining purposes, even though Bitcoin is worth more in the market.

“Features such as untraceable transactions and a proof of work algorithm called CryptoNight, which favours computer or server central processing units, make the cryptocurrency an attractive alternative for cybercriminals. Bitcoin mining, in comparison, requires specialised mining hardware,” he explains.

While the attackers were active around the end of August, there has been no further activity from them and no further infections reported. Attackers have already started losing machines within their botnet.

Researchers believe a new campaign will be launched in the near future.

JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.
Gartner names Proofpoint Leader in enterprise information archiving
The report provides a detailed overview of the enterprise information archiving market and evaluates vendors based on completeness of vision and ability to execute.
Tensions on the rise after Huawei CFO arrest
“Recently our corporate CFO, Meng Wanzhou, was provisionally detained by the Canadian authorities on behalf of the United States of America."
Palo Alto Networks integrates RedLock and VM-Series with AWS Security Hub
AWS Security Hub is designed to provide users with a comprehensive view of their high-priority security alerts and compliance status.
Juniper simplifies data integration to improve threat detection
Updates to the Juniper Advanced Threat Prevention Appliances leverage third-party firewalls and security data sources.
Is mobile shopping compromising your enterprise security?
When employees do their holiday shopping on company resources, security teams have a challenge with the surge in browsing and online transactions.