New Underminer Exploit Kit Discovered Pushing Bootkits and CoinMiners

guest · Jul 28, 2018

New Underminer Exploit Kit Discovered Pushing Bootkits and CoinMiners
July 28, 2018
https://www.bleepingcomputer.com/ne...t-discovered-pushing-bootkits-and-coinminers/

Security researchers have discovered a new exploit kit, currently active mainly in Asian countries, which, they say, has been busy spreading bootkits and cryptocurrency-mining (coinminer) malware.

This new exploit kit (EK) has been named Underminer in a report published yesterday by security firm Trend Micro. The company says it discovered the first clues of its existence last week, around July 17.

According to Trend Micro, most of the web traffic flowing into Underminer is from Japan (70%), while the rest comes from Taiwan (10%), South Korea (6%), and other countries with smaller percentages.
Underminer has been deploying Hidden Bee malware
As for the malware delivery mechanism used in recent campaigns, the EK has been seen using encrypted TCP tunnels to deploy a bootkit first —for OS persistence— and then a coinminer.
Click to expand...

guest · Jul 28, 2018

Related:
Hidden Bee miner spread via download drive-by download toolkit
July 27, 2018
https://www.scmagazine.com/hidden-b...oad-drive-by-download-toolkit/article/784092/

The Hidden Bee cryptominer is being delivered to users via an improved drive-by download toolkit which exploits the CVE-2018-4878 Flash Player vulnerability.

The attack is part of an existing exploitation framework spotted by the Chinese security firm Qihoo360 in 2017 and was recently seen using a newer Flash exploit by Malwarebytes researchers, according to a July 26 blog post.

“This newer Flash exploit (CVE-2018-4878) was not part of the exploit toolkit at the time Qihoo documented it, and seems to be a more recent addition to boost its capabilities,” researchers said in the post. “The shellcode embedded in the exploit is a downloader for the next stage.”

The attacks are spread via malvertising on adult sites that redirect victims to the exploit kit page and based on the ads served and their own telemetry data, researchers believe the campaign is primarily targeting Asian countries.
Click to expand...

Log in or Sign up

New Underminer Exploit Kit Discovered Pushing Bootkits and CoinMiners

guest Guest

guest Guest

Log in or Sign up

New Underminer Exploit Kit Discovered Pushing Bootkits and CoinMiners

guest Guest

guest Guest

Useful Searches