With the help of in-browser mining services like CoinHive, website owners have found an easy way to take over CPUs and print free money. Notorious cybercriminals are also using new techniques to insert miners into computers and turn them into cryptocurrency mining machines. Just last month, the first Firefox extension was discovered to benefit from a similar activity.
Well-known security firm Trend Micro recently published a new finding describing new mining attempts, which were found to be related to the JenkinsMiner malware.
This exploit is currently active and targets Linux servers by exploiting a security flaw that has existed for five years. It is worth noting that the patch for this particular flaw (CVE-2013-2618) is available.
This flaw is basically a site flaw between XSS (site scripting) and editor.php in Cacti Network's Weathermap tool, which is used to visualize network activity by sysadmins.
The countries most affected by this vulnerability are Japan, Taiwan, China, the United States, India, South Korea, Malaysia, Turkey, and Brazil.
As revealed by the research, the vulnerability peaked in February and shows no sign of slowing down this month. As of March 21, hackers have earned around 320 XMR, or about $74,677.
The final payload used for the attack is a modified version of the XMRig miner, which is a legitimate and open-source XMR miner. The version used hides the command line screen and makes settings or parameters unnecessary.
Obviously, the most basic means of easily protecting Linux machines is to update and install the latest patches. So if you have a similar machine, all you have to do is proceed with the relevant updates.
