F5 Networks found a new campaign named Zealot that is designed to mine Monero cryptocurrency on enterprise networks...
and that uses the same Apache Struts vulnerability exploited in the Equifax breach. What other exploits does the Zealot campaign use, and how does it leverage internal networks for cryptomining?
Cybercriminals use whatever methods they can find to compromise systems to make a profit, including cryptomining, ransomware, spamming and distributed denial-of-service attacks, and they often use newly publicized exploits or vulnerabilities to stay one step ahead of the security industry.
For example, when one vulnerability is patched, cybercriminals are often able to incorporate a new vulnerability or add steps in their toolkit to work around the patch. The recent rise in cryptomining indicates a profitable attack outcome by compromised systems, as with F5 Networks' newly discovered cryptomining attack campaign dubbed Zealot.
The Zealot campaign uses a multistep attack comprising different tools to mine Monero coins on compromised systems, including exploits of vulnerabilities in Apache Struts and the DotNetNuke content management system that enable the attackers to gain initial access to a vulnerable system. Zealot then uses the EmpireProject post-exploitation framework, which can be used to take over Linux and Windows systems to run cryptomining malware.
Zealot can also spread through an internal network looking for vulnerable systems by using a Python script that scans the local network and uses the EternalBlue and EternalSynergy exploits to attack the remote system for cryptomining.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Emerging cyberattacks and threats
Related Q&A from Nick Lewis
The Qihoo 360 Core Security team found a Microsoft vulnerability -- named Double Kill -- that affects applications via Office documents. Learn how ... Continue Reading
IBM X-Force found MnuBot -- a new banking Trojan -- manipulating C&C servers in an unusual way. Learn how this is possible and how this malware ... Continue Reading
Researchers at Trend Micro found a new strain of malware -- dubbed FacexWorm -- that targets users via a malicious Chrome extension. Discover how ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.