New Lucifer Variant Used for Cryptocurrency Mining and DDoS

Summary

A new variant of the Lucifer malware is capable of cryptocurrency mining and using infected machines to launch distributed denial-of-service (DDoS) attacks. Lucifer v.2 is part of a large campaign targeting vulnerable Windows devices. The malware scans for ports 135 and 1433 to find targets and initiates a credential stuffing attack to gain access to the system. The malware exploits a number of known vulnerabilities, including CVE-2014-6287, CVE-2018-1000861, CVE-2017-10271, CVE-2018-20062, CVE-2018-7600, CVE-2017-9791, CVE-2019-9081, CVE-2017-0144, CVE-2017-0145, and CVE-2017-8464. When engaging in cryptocurrency mining, the malware uses XMRig to mine Monero. Lucifer exploits vulnerabilities and uses brute-force attacks to spread to other devices on the network.

Recommendations

The NJCCIC recommends users and administrators ensure all devices are updated with the latest patch levels to prevent the exploitation of the above-mentioned vulnerabilities. More information and a list of indicators of compromise can be found in the Unit 42 post.