LemonDuck Unleashes Cryptomining Attacks Through SMB Service Exploits

This post was authored by Aufa and NetbyteSEC Interns (Irham, Idham, Adnin, Nabiha, Haiqal, Amirul) This blog post is intended to give an overall picture of LemonDuck malware exploited SMB by leveraging EternalBlue vulnerability (CVE-2017-0144) for cryptocurrency mining, based on observations from our observatory farm. EternalBlue is a significant vulnerability in Microsoft's Server Message Block (SMB) protocol that has been exploited by numerous malware variants. One such…