January 13, 2020 By David Bisson 3 min read

Last week in security news, researchers discovered that the Mirai-inspired “LiquorBot” IoT botnet came equipped with Monero cryptocurrency mining capabilities. They also witnessed digital attackers outfitting their web skimmers with new evasion techniques and using new variants of DeathRansom to properly encrypt victims’ data. On top of all that and more, a town based in Colorado lost more than a million dollars to threat actors after falling for a business email compromise (BEC) scam.

Top Story of the Week: LiquorBot Embraces Monero Cryptomining Capabilities

LiquorBot first attracted the attention of Bitdefender when its samples infected some of the security firm’s honeypots back in May 2019. A subsequent analysis of the threat revealed that the IoT botnet was using the same command-and-control server as a variant of Mirai. Both botnets even came bundled together in certain dropper scripts.

However, LiquorBot set itself apart from Mirai by being written in the Golang (also known as Go) programming language. Bitdefender’s researchers also spotted the in-development threat using cryptocurrency mining capabilities to mine for Monero.

Source: iStock

Also in Security News

  • SNAKE Ransomware Targeting Organizations’ Corporate Networks: Security researchers discovered that SNAKE, a previously undocumented ransomware written in Golang, deleted a victim’s Shadow Volume Copies before encrypting a victim’s data. It then dropped a ransom note in which it indicated that it had breached the corporate network, reported Bleeping Computer.
  • Unpatched Pulse VPN Servers Susceptible to Sodinokibi Attacks: Security researcher Kevin Beaumont found that attackers had begun abusing a vulnerability in order to remotely view logs and bypass MFA on organizations’ unpatched Pulse VPN servers. They then used those exploits to target organizations with Sodinokibi and other big-game ransomware.
  • Browser Scam Used Fake Windows 10 Desktop to Trick Users: Bleeping Computer came across a new police locker scam, a ruse that claims a victim must pay a fine to unlock their computer. This iteration was unique, however, in that it abused a browser’s full-screen mode to display a fake Windows 10 desktop notification indicating that law enforcement had locked their computer.
  • Colorado Town Tricked Into Sending $1M to BEC Scammers: Back in mid-October, an individual filed a form on the town of Erie, Colorado’s website to request that a construction company with which the town was working begin receiving electronic payments instead of checks. As a result of the form, Erie officials sent more than $1 million to an attacker-controlled account.
  • SideWinder-Linked Attack Actively Exploiting CVE-2019-2215: Trend Micro uncovered a campaign actively exploiting CVE-2019-2215, a use-after-free vulnerability. Upon further analysis, the security firm determined that the SideWinder APT was using three malicious Android apps to abuse the vulnerability and steal unsuspecting users’ device information.
  • New Techniques Used by Attackers to Conceal Web Skimmer Activity: On December 26, 2019, Malwarebytes dissected a web skimmer’s use of steganography to conceal malicious JavaScript code that skimmed credit cards’ details upon execution. The security firm also analyzed another skimmer that used WebSockets instead of HTML to conceal its communication.
  • Anti-Debug Tricks, Fileless Tactics Added by Predator the Thief: Also in December, Fortinet discovered a new Predator the Thief campaign. This attack used version 3.3.4 of the malware, an iteration which arrived with new anti-debug tricks, more complicated assembly code and fileless techniques for the purpose of evading detection.
  • New DeathRansom Samples Capable of Encrypting Users’ Information: Fortinet analyzed a DeathRansom sample with a timestamp of November 16, 2019 and found that the sample encoded but did not encrypt a user’s data upon successful infection. However, an analysis of more recent samples revealed that DeathRansom could now properly encrypt users’ data.
  • City of Las Vegas Revealed It Avoided “Devastating Situation” from Cyber Attack: As reported by ZDNet, the city of Las Vegas detected a network intrusion on January 7, 2020. It immediately sprang into action and took down parts of its network, a response which helped the municipality avoid what could have been, in its words, a “devastating situation.”

Security Tip of the Week: Protect Your IoT Devices

Security professionals can help their organizations protect their IoT devices by taking a multilayered management approach to their smart products by prioritizing device interoperability and employee education across their security programs. They should also research IoT vendors carefully so that they can purchase from or even partner with companies that incorporate security by design into their IoT products.

More from

Regulatory harmonization in OT-critical infrastructure faces hurdles

3 min read - In an effort to enhance cyber resilience across critical infrastructure, the Office of the National Cyber Director (ONCD) has recently released a summary of feedback from its 2023 Cybersecurity Regulatory Harmonization Request for Information (RFI). The responses reveal major concerns from critical infrastructure industries related to operational technology (OT), such as energy, transport and manufacturing. Their worries include the current fragmented regulatory landscape and difficulty adapting to new cyber regulations. The frustration appears to be unanimous. Meanwhile, the magnitude of…

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today