Over 520,000 Windows computers, mainly servers, have been infected with mining software for the Monero cryptocurrency, from the Smominru botnet.
The group that managed to infect the computers operates the largest Botnet network known to date. The activities of this group have attracted the attention of various security researchers, and several companies have published reports on their activity. Because the botnet is spreading rapidly, most previous reports have only covered a part of its overall operation. Those that were mainly involved were Qihoo 360 NetLab GuardiCore, Trend Micro, Kaspersky, Panda Security and Crowdstrike, but also some independent Chinese researchers.
The botnet has infected a total of over 520,000 computers and has generated 8,900 Monero coins, which is equivalent to $2.3 million. The operators of the Smominru botnet use different techniques to infect computers. They mainly rely on the use of two security vulnerabilities of EternalBlue (CVE-2017-0144) and EsteemAudit (CVE-2017-0176), which concern Windows operating systems that are not updated. As GuardiCore pointed out, the botnet has also targeted MySQL servers on Linux, as well as MSSQL databases on Windows.
According to the data collected, most of the victims are located in Russia, India, Taiwan, Ukraine and Brazil. Proofpoint also pointed out that Smominru is now almost twice the size of the Adylkuzz botnet, the first malware family (even before WannaCry) to ever use EternalBlue. On the other hand, Netlab presents Smominru as even more dangerous, reporting that infections on computers reach about 1 million.
