October 3, 2019 By Shane Schick 2 min read

A cryptojacking malware campaign called Lemon_Duck is repeatedly upgrading its attack scripts using open-source repositories, security researchers warn.

Based on the popular EternalBlue exploit best known for its association with the WannaCry attacks, a blog post on Sophos said Lemon_Duck is also spreading rapidly through enterprise networks via fileless script execution — and controlling CPU resources to mine cryptocurrencies.

Scheduled tasks are used to maintain persistence on targeted Windows-based machines as the PowerShell attack scans for listening ports and randomly generates IP addresses. While researchers believed the campaign originated in Asia, telemetry data suggested it is now infecting enterprises around the world.

Inside Lemon_Duck’s Approach

Once Lemon_Duck finds a remote machine with a responsive script, it attempts brute-force attacks to take control of it. At the same time, it checks for the EternalBlue exploit while running through possible login credentials using a password and hash dictionary.

Researchers noted that whoever is behind Lemon_Duck is actively learning from their peers in the cybercrime community. Some of the passwords it attempts to use, for instance, have been identical to those spreading internet of things (IoT) botnets such as Mirai. A pass the hash technique, meanwhile, uses the NTLM Microsoft protocol to break into a targeted computer.

If the PowerShell malware campaign is successful and a download occurs, Lemon_Duck replicates and validates itself on a compromised machine every hour via Windows Scheduled Tasks. This is also the point at which an exploitation module and miner module begins looking for ways to use the machine to get cryptocurrencies.

The attack doesn’t end there, however. Lemon_Duck will work quickly to use the first machine it compromises on a network as a sort of beachhead to propagate itself onto other devices. Beyond using EternalBlue and brute-force techniques, the attackers take advantage of startup files and USB and network drives, researchers added.

Turn Lemon_Duck Into a Lame Duck Attack

One simple way to reduce the risk of a PowerShell attack like Lemon_Duck is ensuring passwords are regularly updated and aren’t among the list of those being tested by the scripts it is using.

In general, IBM experts recommend fending off cryptojacking by blocking the latest scripts using updated intrusion detection and prevention signatures.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today