September 23, 2019 By Shane Schick 2 min read

The Smominru botnet struck more than 90,000 victims and 4,900 networks around the world this past August and continues to launch roughly 4,700 infections a day, according to a recent report.

Guardicore Labs detailed findings from its study of a command-and-control (C&C) server that contained credentials and other details about victims involved in the ongoing campaign. The Smominru botnet has been active for least two years, using the EternalBlue exploit as well as brute-force techniques to spread its infection, and is known by various names, such as Hexmen and MyKings.

Who Does Smominru Target?

Researchers said Smominru has primarily hit small servers running older versions of Microsoft operating systems (OSs). More than half (55 percent) of those infected were running Windows Server 2008, for example, while another 30 percent were running Windows 7.

On average, at least three machines per network were infected by the botnet, while the largest incident tracked included a total of 65 infected hosts. The investigation showed 25 percent of those targeted in the attack were infected more than once, suggesting that systems remained unpatched or that victims failed to close off possible future attack vectors.

Smominru is not known to target specific organizations, but the research showed some clear geographic hot spots. Countries such as Taiwan, China and Russia suffered high rates of infections, along with Brazil and the U.S. Affected organizations included those in higher education, healthcare and even cybersecurity.

In addition to simply infecting machines with malware to mine cryptocurrencies such as Monero, the researchers noted that the botnet also tends to delete scheduled tasks and terminate processes to remove any competing security threats.

PcShare, a remote-access Trojan (RAT), is most likely used to download the cryptocurrency miner, while a worm component allows the botnet to spread even further, the report noted.

Stop the Spread of the Smominru Botnet

IBM research published earlier this year suggested that malware-based cryptomining attacks are on the rise, so enterprises and individual users should be proactive and prepare for the likelihood of such a breach.

In addition to applying patches as soon as they are available, security leaders should consider an in-depth risk assessment to increase visibility into vulnerabilities and block suspicious traffic.

More from

Government cybersecurity in 2025: Former Principal Deputy National Cyber Director weighs in

4 min read - As 2024 comes to an end, it’s time to look ahead to the state of public cybersecurity in 2025.The good news is this: Cybersecurity will be an ongoing concern for the government regardless of the party in power, as many current cybersecurity initiatives are bipartisan. But what will government cybersecurity look like in 2025?Will the country be better off than they are today? What are the positive signs that could signal a good year for national cybersecurity? And what threats should…

FYSA – Adobe Cold Fusion Path Traversal Vulnerability

2 min read - Summary Adobe has released a security bulletin (APSB24-107) addressing an arbitrary file system read vulnerability in ColdFusion, a web application server. The vulnerability, identified as CVE-2024-53961, can be exploited to read arbitrary files on the system, potentially leading to unauthorized access and data exposure. Threat Topography Threat Type: Arbitrary File System Read Industries Impacted: Technology, Software, and Web Development Geolocation: Global Environment Impact: Web servers running ColdFusion 2021 and 2023 are vulnerable Overview X-Force Incident Command is monitoring the disclosure…

2024 trends: Were they accurate?

4 min read - The new year always kicks off with a flood of prediction articles; then, 12 months later, our newsfeed is filled with wrap-up articles. But we are often left to wonder if experts got it right in January about how the year would unfold. As we close out 2024, let’s take a moment to go back and see if the crystal balls were working about how the year would play out in cybersecurity.Here are five trends that were often predicted for…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today