EternalBlue Exploit Serves Beapy Cryptojacking Campaign

guest · Apr 25, 2019

EternalBlue Exploit Serves Beapy Cryptojacking Campaign
April 25, 2019
https://www.bleepingcomputer.com/ne...-exploit-serves-beapy-cryptojacking-campaign/

A cryptojacking campaign uses NSA's leaked DoublePulsar backdoor and the EternalBlue exploit to spread a file-based cryptocurrency malware on enterprise networks in China.

However, information from Symantec adds details about the type of victims and attacker's motivation to use a file-based coinminer instead of the easier to deploy browser-based alternative.
Focus on enterprise
The researchers saw the first signs of Beapy in January and that it "is most heavily affecting enterprises in Asia, with more than 80 percent of its victims located in China, with other victims in South Korea, Japan, and Vietnam."

The campaign starts with email phishing as the initial infection vector, luring the victim to open an attached Excel document that downloads the DoublePulsar malware; [...]
Apart from the SMB exploit, Beapy also relies on Mimikatz post-exploitation tool that extracts Windows passwords. This way, the malware can be sent to patched systems, too.
Click to expand...

Symantec: Beapy: Cryptojacking Worm Hits Enterprises in China

Log in or Sign up

EternalBlue Exploit Serves Beapy Cryptojacking Campaign

guest Guest

Log in or Sign up

EternalBlue Exploit Serves Beapy Cryptojacking Campaign

guest Guest

Useful Searches