October 3, 2019 By Shane Schick 2 min read

A cryptojacking malware campaign called Lemon_Duck is repeatedly upgrading its attack scripts using open-source repositories, security researchers warn.

Based on the popular EternalBlue exploit best known for its association with the WannaCry attacks, a blog post on Sophos said Lemon_Duck is also spreading rapidly through enterprise networks via fileless script execution — and controlling CPU resources to mine cryptocurrencies.

Scheduled tasks are used to maintain persistence on targeted Windows-based machines as the PowerShell attack scans for listening ports and randomly generates IP addresses. While researchers believed the campaign originated in Asia, telemetry data suggested it is now infecting enterprises around the world.

Inside Lemon_Duck’s Approach

Once Lemon_Duck finds a remote machine with a responsive script, it attempts brute-force attacks to take control of it. At the same time, it checks for the EternalBlue exploit while running through possible login credentials using a password and hash dictionary.

Researchers noted that whoever is behind Lemon_Duck is actively learning from their peers in the cybercrime community. Some of the passwords it attempts to use, for instance, have been identical to those spreading internet of things (IoT) botnets such as Mirai. A pass the hash technique, meanwhile, uses the NTLM Microsoft protocol to break into a targeted computer.

If the PowerShell malware campaign is successful and a download occurs, Lemon_Duck replicates and validates itself on a compromised machine every hour via Windows Scheduled Tasks. This is also the point at which an exploitation module and miner module begins looking for ways to use the machine to get cryptocurrencies.

The attack doesn’t end there, however. Lemon_Duck will work quickly to use the first machine it compromises on a network as a sort of beachhead to propagate itself onto other devices. Beyond using EternalBlue and brute-force techniques, the attackers take advantage of startup files and USB and network drives, researchers added.

Turn Lemon_Duck Into a Lame Duck Attack

One simple way to reduce the risk of a PowerShell attack like Lemon_Duck is ensuring passwords are regularly updated and aren’t among the list of those being tested by the scripts it is using.

In general, IBM experts recommend fending off cryptojacking by blocking the latest scripts using updated intrusion detection and prevention signatures.

More from

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded files with potentially dangerous extensions by mid-2023, have changed the threat landscape for the better. Improved endpoint detection also likely forced attackers to shift away from other techniques prominent in 2022, such as using disk image files (e.g. ISO) and…

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today