spread virus through windows terminal service

The botnet has executable modules that get downloaded and driven by the main module, which communicates with the command and control (C2) server over HTTP. The code exploiting the Bluekeep vulnerability is also present but it is disabled in the version we analysed.

The actor also employs several exploits for vulnerabilities such as SMBGhost and Eternal Blue. The infection starts with a PowerShell loading script, which is copied from other infected systems with SMB, email or external USB drives. The adversary also uses tools such as Mimikatz, that help the botnet increase the amount of systems participating in its mining pool.Īlthough this threat has been active since at least the end of December 2018, we have noticed an increase in its activity at the end of August 2020. In recent attacks we observed, this functionality was omitted.

Some variants also support RDP brute-forcing. The actor employs various methods to spread across the network, like sending infected RTF files using email, psexec, WMI and SMB exploits, including the infamous Eternal Blue and SMBGhost threats that affect Windows 10 machines. This threat, known as 'Lemon Duck,' has a cryptocurrency mining payload that steals computer resources to mine the Monero virtual currency. Cisco Talos recently discovered a complex campaign employing a multi-modular botnet with multiple ways to spread. These threats demonstrate several techniques of the MITRE ATT&CK framework, most notably T1203 (Exploitation for Client Execution), T1089 (Disabling Security Tools), T1105 (Remote File Copy), T1027 (Obfuscated Files or Information), T1086 (PowerShell), T1035 (Service Execution), T1021.002 (Remote Services: SMB/Windows Admin Shares), T1053 (Scheduled Task), T1562.004 (Impair Defenses: Disable or Modify System Firewall) and T1218.005 (Signed Binary Proxy Execution: Mshta).Īttackers are constantly reinventing ways of monetizing their tools.

We are used to ransomware attacks and big-game hunting making headlines, but there are still methods adversaries use to monetize their efforts in less intrusive ways.Ĭisco Talos recently recorded increased activity of the Lemon Duck cryptocurrency-mining botnet using several techniques likely to be spotted by defenders, but are not immediately obvious to end-users. By Vanja Svajcer, with contributions from Caitlin Huey.

Spread virus through windows terminal service