article thumbnail

Hackers hijacked the eScan Antivirus update mechanism in malware campaign

Security Affairs

A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute backdoors and cryptocurrency miners. GuptiMiner connects directly to malicious DNS servers, bypassing the DNS network entirely. The final payload distributed by GuptiMiner was also XMRig.

article thumbnail

Crooks social-engineered GoDaddy staff to take over crypto-biz domains

Security Affairs

Crooks were able to trick GoDaddy staff into handing over control of crypto-biz domain names in a classic DNS hijacking attack. Crooks were able to hijack traffic and email to various cryptocurrency-related websites as a result of a DNS hijacking attack on domains managed by GoDaddy. SecurityAffairs – hacking, DNS hijacking).

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

DirtyMoe botnet infected 100,000+ Windows systems in H1 2021

Security Affairs

The Windows botnet has been active since late 2017, it was mainly used to mine cryptocurrency, but it was also involved in DDoS attacks in 2018. Communication with C&C servers is based on DNS requests and it uses a special mechanism translating DNS results to a real IP address. ” concludes the analysis.”

DNS 127
article thumbnail

Crackonosh Monero miner made $2M after infecting 222,000 Win systems

Security Affairs

Researchers have discovered a strain of cryptocurrency-mining malware, tracked as Crackonosh, that abuses Windows Safe mode to avoid detection. . Researchers from Avast have spotted a strain of cryptocurrency miner, tracked as Crackonosh, that abuses Windows Safe mode to avoid detection. ” reads the analysis published by Avast.

Antivirus 108
article thumbnail

Security Affairs newsletter Round 385

Security Affairs

Every week the best security articles from Security Affairs free for you in your email box. builder Over 39K unauthenticated Redis services on the internet targeted in cryptocurrency campaign Hackers stole $160 Million from Crypto market maker Wintermute U.S.

article thumbnail

Cryptomining DreamBus botnet targets Linux servers

Security Affairs

. “These particular applications are targeted because they often run on systems that have powerful underlying hardware with significant amounts of memory and powerful CPUs—all of which allow threat actors to maximize their ability to monetize these resources through mining cryptocurrency.” Ransomware, data theft).

article thumbnail

Glupteba botnet is back after Google disrupted it in December 2021

Security Affairs

The botnet was involved in stealing users’ credentials and data, mining cryptocurrencies abusing victims’ resources, and setting up proxies to funnel other people’s internet traffic through infected machines and routers. Botnet operators use to spread the malware via cracked or pirated software and pay-per-install (PPI) schemes. .

DNS 97