For two years a malware called Lemon Duck has been infecting computers for Monero mining. In the last two months, its activity has increased at an alarming rate.
Cisco Talos researchers have been monitoring the Lemon Duck botnet since December 2018. Since August they have seen a large increase in the number of communications with the servers that control Lemon Duck activity.
Cisco Talos notes that malware is designed to spread in many ways.
Sometimes new computers are automatically infected using known vulnerabilities such as EternalBlue - which was also used by the famous malware WannaCry.
Like many other malware groups that have spread since the beginning of the Coronavirus pandemic, Lemon Duck also uses COVID-19 phishing email.
Emails are very simple with theme the pandemic, (“COVID-19” or “The Truth of COVID-19”) and contain from an infected Microsoft Word document.
Mining cryptocurrencies like Monero can be a very intensive process. The harder the processors work, the more heat they generate. Without sufficient cooling to compensate for the heating, the hardware is in danger.
The criminals behind Lemon Duck want to make sure that mode τους είναι επικερδής. Αυτός είναι ο λόγος για τον οποίο η Lemon Duck ελέγχει τα μολυσμένα machinemata and terminates them.