Nansh0u Cryptomi’s malware accounts for 50,000 servers

It was last updated on June 18, 2019

Nansh0u malware annotation campaign infects nearly 12,000 Windows MS-SQL and PHPMyAdmin servers
Above the world

Guardicore investigators have uncovered a secret you can see on websites from April 26 to April 11 this year, on May 29th.
[And he says a lot
The most common attacks of cryptocurrency are the use of counterfeit coins and certificates of success in order to develop
privilege.

If attacks are detected, all three people have their own IP address
From South Africa and hosts IRS VolumeDrive. Besides
Events that include one form of attack, one curtain over another
The role and use of this method violates the contract and the steps taken after the contract is received

The researchers looked at 20 versions of the malware and said they were new
During pregnancy, remove the load once a week and put it on immediately
The time has come for companies to launch cyber attacks
Health, telecommunications, media and information technology.

If the server fails, the assigned server will become infected
Release cryptocurrency and install malware
The enhanced kernel rootkit mode protects against malware
You’re done

All attacked servers are HFS [HTTP File Server
If there are seeds
The infrastructure has all the modules for success.
Recent attacks on MS-SQL servers, including port scanners and MS-SQL
Abuse of remote power corridors and cables.

Bad actors also have advantages
The load includes vascular drops, thin mode and basic mode
Everyone shows that the attacker is not a member of the nation state
Use high level weapons.

Clearly, this masterpiece was developed during the ISP analysis phase
From the exchange rate of stolen securities in cryptocurrency mining,
Investigators at the scene said. Consequently, there are plenty of mistakes and mistakes
No effort was made correctly.

This was one of the bugs in two versions lcn.exe
They were all paid by the same owner, but in return
Information on the command line. This indicates that the first phase was created
The wallet’s address is wrong, investigators say. .

Fortunately, the searchers found the owners of the reception
Attack server as host is a partitioning stamp
The investigation was on a suspected server that was interrupted and the document was lost
To destroy.