singkham - Fotolia
F5 Networks found a new campaign named Zealot that is designed to mine Monero cryptocurrency on enterprise networks and that uses the same Apache Struts vulnerability exploited in the Equifax breach. What other exploits does the Zealot campaign use, and how does it leverage internal networks for cryptomining?
Cybercriminals use whatever methods they can find to compromise systems to make a profit, including cryptomining, ransomware, spamming and distributed denial-of-service attacks, and they often use newly publicized exploits or vulnerabilities to stay one step ahead of the security industry.
For example, when one vulnerability is patched, cybercriminals are often able to incorporate a new vulnerability or add steps in their toolkit to work around the patch. The recent rise in cryptomining indicates a profitable attack outcome by compromised systems, as with F5 Networks' newly discovered cryptomining attack campaign dubbed Zealot.
The Zealot campaign uses a multistep attack comprising different tools to mine Monero coins on compromised systems, including exploits of vulnerabilities in Apache Struts and the DotNetNuke content management system that enable the attackers to gain initial access to a vulnerable system. Zealot then uses the EmpireProject post-exploitation framework, which can be used to take over Linux and Windows systems to run cryptomining malware.
Zealot can also spread through an internal network looking for vulnerable systems by using a Python script that scans the local network and uses the EternalBlue and EternalSynergy exploits to attack the remote system for cryptomining.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Emerging cyberattacks and threats
Related Q&A from Nick Lewis
Enterprises new to the cloud can write new security policies from scratch, but others with broad cloud usage may need an update. Consider these ... Continue Reading
Cloud security providers need to play catch-up with the evolving advancements in cloud technology. Find out what the top CSPs offer today and which ... Continue Reading
Cloud security certifications serve to bolster security professionals' resumes and boost value to employers. Learn about the top certifications ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.