A cryptojacking malware campaign called Lemon_Duck is repeatedly upgrading its attack scripts using open-source repositories, security researchers warn.

Based on the popular EternalBlue exploit best known for its association with the WannaCry attacks, a blog post on Sophos said Lemon_Duck is also spreading rapidly through enterprise networks via fileless script execution — and controlling CPU resources to mine cryptocurrencies.

Scheduled tasks are used to maintain persistence on targeted Windows-based machines as the PowerShell attack scans for listening ports and randomly generates IP addresses. While researchers believed the campaign originated in Asia, telemetry data suggested it is now infecting enterprises around the world.

Inside Lemon_Duck’s Approach

Once Lemon_Duck finds a remote machine with a responsive script, it attempts brute-force attacks to take control of it. At the same time, it checks for the EternalBlue exploit while running through possible login credentials using a password and hash dictionary.

Researchers noted that whoever is behind Lemon_Duck is actively learning from their peers in the cybercrime community. Some of the passwords it attempts to use, for instance, have been identical to those spreading internet of things (IoT) botnets such as Mirai. A pass the hash technique, meanwhile, uses the NTLM Microsoft protocol to break into a targeted computer.

If the PowerShell malware campaign is successful and a download occurs, Lemon_Duck replicates and validates itself on a compromised machine every hour via Windows Scheduled Tasks. This is also the point at which an exploitation module and miner module begins looking for ways to use the machine to get cryptocurrencies.

The attack doesn’t end there, however. Lemon_Duck will work quickly to use the first machine it compromises on a network as a sort of beachhead to propagate itself onto other devices. Beyond using EternalBlue and brute-force techniques, the attackers take advantage of startup files and USB and network drives, researchers added.

Turn Lemon_Duck Into a Lame Duck Attack

One simple way to reduce the risk of a PowerShell attack like Lemon_Duck is ensuring passwords are regularly updated and aren’t among the list of those being tested by the scripts it is using.

In general, IBM experts recommend fending off cryptojacking by blocking the latest scripts using updated intrusion detection and prevention signatures.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…