"Lucifer" is a real problem for businesses
Researchers have discovered a devilishly clever new stain of malware currently in use by hackers around the world. The new strain is appropriately called "Lucifer," and has been making life quite difficult for IT professionals managing Windows environments.
The malware exploits critical vulnerabilities in Windows-based systems to launch DDoS attacks and install cryptojacking code.
The latest version (2.0) of the code was discovered by researchers Durgesh Sangvikar, Zhibin Zhang, Chris Navarrete, and Ken Hsu, on May 29, 2020. They discovered it while investigating the exploit of CVE-2019-9081, which is a deserialization bug in Laravel Framework that can be used to conduct RCE (Remote Code Execution) attacks.
CVE-2019-9081 is just one of many critical security flaws Lucifer exploit
The others include the following:
- CVE-2014-6287
- CVE-2018-1000861
- CVE-2017-10271
- CVE-2018-20062
- CVE-2018-7600
- CVE-2017-9791
- CVE-2019-9081
- CVE-2017-0144
- CVE-2017-0145
- CVE-2017-8464
Few malware strains incorporate code designed to exploit so many different security flaws, which makes Lucifer a serious threat indeed.
If there's a silver lining to be found, it is in the fact that all of these flaws have already been addressed via patches. So it comes down to making sure your software is up to date and running the latest and greatest security patches. The researchers who discovered it say that there are ongoing campaigns that are currently wreaking havoc on unpatched systems and urge all system admins to make sure the software they're running is patched as soon as possible.
In practice, Lucifer 2.0 works by scanning for open TCP ports 135 (RPC) and 1433 (MSSQL). When it finds a potential target, it will use credential-stuffing attacks to gain access to the targeted system. Once it gains a foothold, it installs XMRig, which is a program used to covertly mine Monero (XMR) cryptocurrency. Additionally, the malware connects to a command and control server where it can receive additional instructions.
Our perspective
As we said, it's a serious piece of work and not to be taken lightly.
~ As Hill Street Blues' Sgt. Esterhaus always advised: "Hey, let's be careful out there! " ~
By Denis Wilson and Melissa Stockwell
Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. I am also available on LinkedIn, Facebook, and Twitter.
I'm Denis Wilson, President and Principal Consultant for DWP Information Architects. We build people / process / technology solutions to create better business outcomes for smaller enterprises in Los Angeles. We have created cost-effective office productivity and out-sourced service solutions for over 20 years, focusing principally on manufacturing and healthcare. Our hallmarks are reliability, cybersecurity, and regulatory compliance.
I am also a published author and speaker, working extensively with business and professional associations to provide small business technology education programs.
Contact me if you would like me to speak at your association
