A new botnet is exploiting close to a dozen high and critical-severity vulnerabilities in Windows systems to turn them into cryptomining clients as well as to launch DDoS attacks.
The malware behind the botnet has been given the name Satan DDoS though security researchers have taken to referring to its as Lucifer in order to avoid confusion with the Satan ransomware.
Palo Alto Networks’ Unit 42 began looking into the botnet after the company’s researchers discovered it while following multiple incidents involving the exploitation of a critical vulnerability in a component of the Laravel web framework which can lead to remote code execution.
At first the Lucifer malware was believed to be used to mine the cryptocurrency Monero. However, it later become apparent that the malware also contains a DDoS component as well as a self-spreading mechanism that uses severe vulnerabilities and brute-forcing to its advantage.
Lucifer malware
In a blog post, Unit 42 provided further details on just how powerful the capabilities of the Lucifer malware are, saying:
“Lucifer is quite powerful in its capabilities. Not only is it capable of dropping XMRig for cryptojacking Monero, it’s also capable of command and control (C2) operation and self-propagation through the exploitation of multiple vulnerabilities and credential brute-forcing. Additionally, it drops and runs EternalBlue, EternalRomance, and DoublePulsar backdoor against vulnerable targets for intranet infections.”
The operators behind Lucifer have weaponized exploits for 11 different vulnerabilities which have all since been patched. However, cybercriminals often leverage older vulnerabilities to prey on users who have yet to patch their systems.
The latest version of the botnet malware also includes anti-analysis protection which allows it to check the user and computer name of an infected machine before carrying out its operations. If any names are found that correspond with analysis environments, the malware stops.
To protect against Lucifer, businesses and individuals should keep their software updated with the latest patches and use strong passwords.
Via BleepingComputer