Threat Actors Deliver Cryptocurrency Miners Via Neptune Exploit Kit

Cybercriminals are using an exploit kit called Neptune to drive malvertising campaigns. According to security firm FireEye, Neptune is a resurgence of an older exploit kit known as Sundown, or Terror. But the new variant has some different internals and a Monero mining payload.

How Neptune Works

The newest attack variants for Neptune features changes in uniform resource identifier (URI) patterns, landing pages, the actual malvertising used and the specific payloads it carries. FireEye reported that most of the ads linked to this campaign were observed on high-traffic torrent and multimedia hosting sites.

Malicious actors used a legitimate pop-up ad service via Alexa’s Top 100 to push out fake advertisements for hiking clubs. Landing page redirects from the domains associated with these ads use 302-style redirects. The pages that the victims are redirected to look legitimate to the casual observer — except for the URL changes.

The landing page that actually triggers the Neptune exploit kit will then redirect the victim to other Internet Explorer and Adobe Flash exploit links. Before it does that, however, it checks the Flash versions that have been installed on the victim’s machine.

The eventual payload is a Monero miner, which has an $86 per-unit value at this time. Once activated, the payload tries to first connect to a mining website. It then conducts a login attempt to use the CPUminer service with a login email that purports to be from [email protected].

Exploit Kit Malvertisements and Security

SecurityWeek observed that the campaign’s major targets include South Korea (29 percent), Europe (19 percent), Thailand (13 percent), the Middle East (13 percent) and the U.S. (10 percent).

The vulnerabilities that Neptune takes advantage of were disclosed between 2014 and 2016, so they are not brand new. Contemporary patching should have already taken care of them. Failing to update software to the latest version will put users at risk, especially considering that exploit kit malvertisements can secretly download arbitrary payloads.

Security managers should stay vigilant when it comes to variants of older threats, since users may not ever be aware that they have been affected. Monitoring any unusual external internet or CPU activity can help to identify the victims of this stealthy exploit kit.

Larry Loeb

Principal, PBC Enterprises

NIST’s role in the global tech race against AI

4 min read - Last year, the United States Secretary of Commerce announced that the National Institute of Standards and Technology (NIST) has been put in charge of launching a new public working group on artificial intelligence (AI) that will build on the success of the NIST AI Risk Management Framework to address this rapidly advancing technology.However, recent budget cuts at NIST, along with a lack of strategy implementation, have called into question the agency’s ability to lead this critical effort. Ultimately, the success…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

How Neptune Works

Exploit Kit Malvertisements and Security

More from

NIST’s role in the global tech race against AI

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

Topic updates