When coin miners evolve, Part 2: Hunting down LemonDuck and LemonCat attacks

🗓️ 29 Jul 2021 19:00:59Reported by Eric AvenaType

mmpc🔗 www.microsoft.com👁 1592 Views

Analyzing LemonDuck and LemonCat attacks, their impact, behavior, and mitigation

Reporter	Title	Published	Views	Family All 1285
zdt	Microsoft Windows - Uncredentialed SMB RCE (MS17-010) Exploit	17 Apr 201700:00	–	zdt
zdt	Microsoft Windows - SrvOs2FeaToNt SMB Remote Code Execution (MS17-010) Exploit	10 May 201700:00	–	zdt
zdt	Microsoft Windows MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption Exploit	17 May 201700:00	–	zdt
zdt	Microsoft Windows 7 / 2008 R2 (x64) - EternalBlue SMB Remote Code Execution (MS17-010) Exploit	19 May 201700:00	–	zdt
zdt	Microsoft Windows 8 / 2012 R2 (x64) - EternalBlue SMB Remote Code Execution (MS17-010) Exploit	19 May 201700:00	–	zdt
zdt	Microsoft Windows - LNK Shortcut File Code Execution Exploit	26 Jul 201700:00	–	zdt
zdt	Microsoft Windows - LNK Shortcut File Code Execution Exploit	6 Aug 201700:00	–	zdt
zdt	Microsoft Windows LNK File Code Execution Exploit	9 Nov 201700:00	–	zdt
zdt	Microsoft Windows Remote Desktop - BlueKeep Denial of Service Exploit	31 May 201900:00	–	zdt
zdt	Microsoft Windows Remote Desktop - (BlueKeep) Denial of Service Exploit	15 Jul 201900:00	–	zdt

29 Jul 2021 19:00Current

0.5Low risk

Vulners AI Score0.5

EPSS0.99999

malware cryptocurrency security controls botnet credential theft email campaigns lateral movement human-operated actions investigation guidance vulnerabilities microsoft exchange web shells access control soc analysis