New Powerful Malware Is Targeting Windows-Based Machines

Researchers have discovered a devilishly clever new stain of malware currently in use by hackers around the world. The new strain is appropriately called “Lucifer,” and has been making life quite difficult for IT professionals managing Windows environments.

The malware exploits critical vulnerabilities in Windows-based systems to launch DDoS attacks and install cryptojacking code.

The latest version (2.0) of the code was discovered by researchers Durgesh Sangvikar, Zhibin Zhang, Chris Navarrete, and Ken Hsu, on May 29, 2020. They discovered it while investigating the exploit of CVE-2019-9081, which is a deserialization bug in Laravel Framework that can be used to conduct RCE (Remote Code Execution) attacks.

Few malware strains incorporate code designed to exploit so many different security flaws, which makes Lucifer a serious threat indeed.

If there’s a silver lining to be found, it is in the fact that all of these flaws have already been addressed via patches. So it comes down to making sure your software is up to date and running the latest and greatest security patches. The researchers who discovered it say that there are ongoing campaigns that are currently wreaking havoc on un-patched systems and urge all system admins to make sure the software they’re running is patched as soon as possible.

In practice, Lucifer 2.0 works by scanning for open TCP ports 135 (RPC) and 1433 (MSSQL). When it finds a potential target, it will use credential-stuffing attacks to gain access to the targeted system. Once it gains a foothold, it installs XMRig, which is a program used to covertly mine Monero (XMR) cryptocurrency. Additionally, the malware connects to a command and control server where it can receive additional instructions.

As we said, it’s a serious piece of work and not to be taken lightly.