The Smominru botnet struck more than 90,000 victims and 4,900 networks around the world this past August and continues to launch roughly 4,700 infections a day, according to a recent report.

Guardicore Labs detailed findings from its study of a command-and-control (C&C) server that contained credentials and other details about victims involved in the ongoing campaign. The Smominru botnet has been active for least two years, using the EternalBlue exploit as well as brute-force techniques to spread its infection, and is known by various names, such as Hexmen and MyKings.

Who Does Smominru Target?

Researchers said Smominru has primarily hit small servers running older versions of Microsoft operating systems (OSs). More than half (55 percent) of those infected were running Windows Server 2008, for example, while another 30 percent were running Windows 7.

On average, at least three machines per network were infected by the botnet, while the largest incident tracked included a total of 65 infected hosts. The investigation showed 25 percent of those targeted in the attack were infected more than once, suggesting that systems remained unpatched or that victims failed to close off possible future attack vectors.

Smominru is not known to target specific organizations, but the research showed some clear geographic hot spots. Countries such as Taiwan, China and Russia suffered high rates of infections, along with Brazil and the U.S. Affected organizations included those in higher education, healthcare and even cybersecurity.

In addition to simply infecting machines with malware to mine cryptocurrencies such as Monero, the researchers noted that the botnet also tends to delete scheduled tasks and terminate processes to remove any competing security threats.

PcShare, a remote-access Trojan (RAT), is most likely used to download the cryptocurrency miner, while a worm component allows the botnet to spread even further, the report noted.

Stop the Spread of the Smominru Botnet

IBM research published earlier this year suggested that malware-based cryptomining attacks are on the rise, so enterprises and individual users should be proactive and prepare for the likelihood of such a breach.

In addition to applying patches as soon as they are available, security leaders should consider an in-depth risk assessment to increase visibility into vulnerabilities and block suspicious traffic.