Weeks Before WannaCry, Cryptocurrency Mining Botnet Was Using Windows SMB Exploit

A security researcher has just discovered a stealthy cryptocurrency-mining malware that was also using

Windows SMB vulnerability

at least two weeks before the outbreak of

WannaCry ransomware

attacks.

According to Kafeine, a security researcher at Proofpoint, another group of cyber criminals was using the same

EternalBlue exploit

, created by the NSA and dumped last month by the Shadow Brokers, to infect hundreds of thousands of computers worldwide with a cryptocurrency mining malware called '

Adylkuzz

.'

This malicious campaign went unnoticed for weeks because unlike

WannaCry

, this malware does not install ransomware or notify victims, but instead, it quietly infects unpatched computers with malware that only mine '

Monero

,' a Bitcoin-like cryptocurrency.

This Malware Saves Computers From Getting Hacked By WannaCry

The Researcher believes Adylkuzz malware attack could be larger in scale than WannaCry ransomware attack because it has been designed to block SMB ports of a targeted computer after hijacking it.

In other words, Adylkuzz malware infects unpatched computers and then closes SMB ports to prevent them from further infections, which may have indirectly saved hundreds of thousand of computers from getting hacked by

WannaCry ransomware

as well.

Mining cryptocurrencies can be a costly investment as it requires an enormous amount of computing power, but the Adylkuzz cryptocurrency-mining malware makes it easier for cybercriminals by allowing them to utilize computing resources of compromised systems and makes lots and lots of dollars.

"Once infected through use of the EternalBlue exploit, the cryptocurrency miner Adylkuzz is installed and used to generate cybercash for the attackers," said Robert Holmes, vice president of products at Proofpoint.

One Monero is currently valued at around US$26.77.

"While an individual laptop may generate only a few dollars per week, collectively the network of compromised computers appears to be generating five-figure payouts daily," the researchers added.

According to Proofpoint, tens of thousands of computers across the world have been infected by the Adylkuzz malware.

Despite people's efforts to patch their systems to prevent themselves from the

WannaCry menace

, Proofpoint believes the Adylkuzz attack is still growing and targeting Windows machines.

Last week, in a separate research, GuardiCore researchers uncovered a new botnet malware, dubbed

BondNet

, that was also infecting Windows machines worldwide, with a combination of techniques, for mining cryptocurrencies — primarily Monero, but also ByteCoin, RieCoin, and ZCash.

If this isn't enough, you'll find yourself worry after knowing that the hacking group, Shadow Brokers, who last month leaked the Windows SMB exploit, is back,

promising to release more zero-days

 vulnerabilities and exploits starting from June.

So, the best key to keeping yourself safe is that instead of worrying about your devices, just patch them with the latest updates and follow some basic security tips that I have mentioned in my previous article about

how to disable SMB

and prevent your machines from WannaCry, cryptocurrency mining malware, and other malware.

from The Hacker News http://ift.tt/2rcFX7b