Lucifer botnet now infecting Linux-based systems
The Lucifer malware infects machines and forms a botnet to mine cryptocurrency
Lucifer, a botnet using infected Windows devices to mine cryptocurrency, is now affecting Linux-based systems as well.
That's according to the researchers from Netscout's ATLAS Security Engineering & Response Team (ASERT), who claim that the Linux version of Lucifer is as powerful as its Windows counterpart. The malware includes modules for cryptojacking as well as launching UCP, ICMP, TCP and HTTP-based distributed denial-of-service (DDoS) attacks against vulnerable systems.
Researchers at Palo Alto Networks' Unit 42 uncovered Lucifer in May. They showed the botnet was exploiting various unpatched bugs in Windows devices to enable attackers to run arbitrary code on compromised systems.
The researchers also noticed that cyber criminals were using Lucifer malware to deploy an XMRig miner on vulnerable machines. After infecting a device, the botnet would plant XMRig to mine Monero cryptocurrency, and start using the compromised device to launch DDoS attacks against other targets.
While malware operators referred to their malware as 'Satan DDoS', Unit42 named it Lucifer to avoid confusion with the Satan ransomware.
According to ASERT, the newest version of the malware has new capabilities, including the ability to plant a Mimikatz PowerShell script on vulnerable machines to steal credentials and escalate privileges within infected Windows machines.
Moreover, it can also potentially compromise high-performance, high-bandwidth servers in internet data centres. The researchers said, "each node [is capable of] packing a larger punch in terms of DDoS attack capacity than is typical of most bots running on Windows or IoT-based Linux devices.
"Additionally, Lucifer supports HTTP application-layer attacks, including basic HTTP GET- and POST-floods, as well as multiple versions of HTTP 'CC' DDoS attacks."
The ASERT team was able to link the Linux versions of Lucifer to its older version, as both variants used the same command-and-control (C&C) infrastructure to conduct attacks.
The researchers believe the authors of Lucifer are actively working on new features to expand its footprint and to enhance its penetration capabilities.
"As IoT devices are almost always based on various Linux distributions, it would not be a huge stretch to see Lucifer recompiled to run on IoT-based devices and include common IoT vulnerabilities as an infection method," the researchers said.
"We anticipate seeing the number of Linux and cross-platform bots such as Lucifer grow in the future."
More on Threats and Risks
North Korean hacking group is using BLINDINGCAN malware to attack defence firms, warns CISA
Hackers are sending spam mails that purport to come from big defence contractors to trap potential targets
Microsoft's out of band security update fixes flaw in Windows Remote Access service
The vulnerabilities could allow threat actors to gain elevated privileges on a victim's machine
HTML smuggling technique behind 'Duri' campaign to deliver malware, researchers warn
The attack can evade network security solutions, including firewalls, legacy proxies and sandboxes
Researchers exploited a bug in Emotet malware to create a killswitch, containing its spread for six months
But Emotet's operators have now patched the flaw
PoC exploit to target two Apache Struts 2 flaws emerges on GitHub
Upgrade to latest Struts version immediately, warns Apache Struts Security Team
Most read
