ZombieBoy, a new crypto-mining family, recently clocked in at 43 KH/s — or $1,000 per month at current Monero prices.

Independent security researcher James Quinn described ZombieBoy, a new family of crypto-mining malware, in AlienVault on July 18. The name comes from the ZombieBoyTools kit the malware uses to drop its first dynamic link library (DLL) file. Much like MassMiner, ZombieBoy is a highly infectious worm, but it uses WinEggDrop rather than MassScan to identify new hosts.

Before recently shutting down one of its addresses on Monero mining pool MineXMR, the crypto-mining malware was raking in approximately $1,000 worth of the digital currency every month, according to Quinn. Based on its use of the Simplified Chinese language, ZombieBoy likely originates from China.

ZombieBoy Exploits Multiple CVEs to Beat Security Defenses

ZombieBoy leverages multiple vulnerabilities to compromise networks, including CVE-2017-9073, a remote desktop protocol (RDP) vulnerability on XP and Server 2003, and Server Message Block (SMB) exploits CVE-2017-0143 and CVE-2017-0146. It then uses DoublePulsar and EternalBlue to create multiple backdoors, both increasing the chance of compromise and making it harder for IT teams to eliminate infections.

The crypto-mining malware is encrypted with Themdia and won’t run on virtual machines (VMs). This makes it hard to both capture and reverse engineer, limiting the efficacy and development of countermeasures.

ZombieBoyTools is linked to other Chinese malware like IRON TIGER APT (itself a variant of Gh0st RAT). This suggests not only persistence but also continued evolution. ZombieBoy’s double backdoors could pave the way for crypto-mining malware and leave the gate open for ransomware, keyloggers and other malicious tools.

How Can Companies Combat Crypto-Mining Malware?

While it’s tough to stop threats like ZombieBoy outright, companies can take action to limit risk. IBM security researchers recommend blocking command-and-control (C&C) traffic that exploits like DoublePulsar and EternalBlue rely on using signatures such as SMB_EternalBlue_Implant_CnC and SMB_DoublePulsar_Implant_CnC.

Security experts also recommend building intelligent, integrated immune systems capable of responding to multiple threats, including crypto-mining, ransomware and distributed denial-of-service (DDoS) attacks. This ecosystem of solutions should include two-factor authentication (2FA), advanced web application firewalls and the ability to limit or disable unused ports and services.

Source: Alien Vault


More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…