New Delhi: Security researchers have discovered that the Smominru malware infected 90,000 machines worldwide during the month of August, with an infection rate of up to 4,700 computers per day.
Malware steals victim credentials In its post-infection phase, it steals victim credentials, installs a Trojan module and a cryptominer and propagates inside the network, according to researchers from Guardicore, a data centre and cloud security company.
The botnet uses several methods to propagate, but primarily it infects a system in one of two ways — either by brute-forcing weak credentials for different Windows services, or more commonly by relying on the infamous EternalBlue exploit, cybersecurity firm Kaspersky said in a blog post last week.
Kaspersky’s statement Even though Microsoft patched the vulnerability EternalBlue exploits, which made the WannaCry and NotPetya outbreaks possible, many companies are simply ignoring updates, Kaspersky said.
China, Taiwan, Russia, Brazil and the US have seen the most attacks, but that doesn’t mean other countries are out of its scope. For example, the largest network Smominru targeted was in Italy, with 65 hosts infected.
The criminals involved are not too particular about their targets, which range from universities to healthcare providers.
Related stories
Subscribe
- Never miss a story with notifications
- Gain full access to our premium content
- Browse free from up to 5 devices at once
Latest stories