Security researchers discover malware that infected 90,000 computers worldwide

Agencies
October 8, 2019

Security researchers have discovered that the Smominru malware infected 90,000 machines worldwide during the month of August, with an infection rate of up to 4,700 computers per day.

In its post-infection phase, it steals victim credentials, installs a Trojan module and a cryptominer and propagates inside the network, according to researchers from Guardicore, a data centre and cloud security company.

The botnet uses several methods to propagate, but primarily it infects a system in one of two ways -- either by brute-forcing weak credentials for different Windows services, or more commonly by relying on the infamous EternalBlue exploit, cybersecurity firm Kaspersky said in a blog post last week.

Even though Microsoft patched the vulnerability EternalBlue exploits, which made the WannaCry and NotPetya outbreaks possible, many companies are simply ignoring updates, Kaspersky said.

China, Taiwan, Russia, Brazil and the US have seen the most attacks, but that doesn't mean other countries are out of its scope. For example, the largest network Smominru targeted was in Italy, with 65 hosts infected.

The criminals involved are not too particular about their targets, which range from universities to healthcare providers.

However, one detail is very consistent. About 85 per cent of infections occur on Windows 7 and Windows Server 2008 systems. The rest include Windows Server 2012, Windows XP and Windows Server 2003.

After compromising the system, Smominru creates a new user, called admin$, with admin privileges on the system and starts to download a whole bunch of malicious payloads.

The most obvious objective is to silently use infected computers for mining cryptocurrency (namely, Monero) at the victim's expense.

The malware also downloads a set of modules used for spying, data exfiltration, and credential theft.

On top of that, once Smominru gains a foothold, it tries to propagate further within the network to infect as many systems as possible.

To protect their network, computers, and data from Smominru, users need to update operating systems and other software regularly, Kaspersky said.

It is also important for users to use strong passwords. A reliable password manager that helps you create, manage, and automatically retrieve and enter passwords may help protect you against brute-force attacks.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
June 17,2020

In a bid to help tackle rise in domestic violence during the social distancing times in India, Twitter on Wednesday launched a dedicated search prompt to serve information and updates from authoritative sources around domestic violence.

Twitter has partnered with the Ministry of Women and Child Development the National Commission for Women in India to expand its efforts towards women.

The search prompt will be available on iOS, Android and on mobile.twitter.com in India, in both English and Hindi languages, the company said in a statement.

Data shows that since the outbreak of Covid-19, violence against women and girls has intensified in India and across the globe.

"We recognise collaboration with the public, government and NGOs is key to combating the complex issue of domestic violence. Accessing reliable information through this search prompt could be a survivor's first step towards seeking help against abuse and violence," said Mahima Kaul, Director, Public Policy, India and South Asia, Twitter.

Every time someone searches for certain keywords associated with the issue of domestic violence, a prompt will direct them to the relevant information and sources of help available on Twitter.

This is an expansion of Twitter's #ThereIsHelp prompt, which was specifically put in place for the public to find clear, credible information on critical issues.

The feature will be reviewed at regular intervals by the Twitter team to ensure that all related keywords generate the proactive search prompt, said the company.

Violence against women and girls across Asia Pacific is pervasive but at the same time widely under reported.

"In fact, in many countries in our region, the number is even greater, with as many as 2 out of 3 women in some countries reporting experiences of violence," added Melissa Alvarado, UN Women Asia Pacific Regional Manager on Ending Violence against Women.

Rekha Sharma, Chairperson, the NCW, said: "With social distancing norms in place, several women are unable to contact their regular support systems. This initiative by Twitter will provide big support to the survivors, who would otherwise be easily isolated without access to relevant information and help".

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
May 19,2020

Cybersecurity researchers on Monday warned of a Trojan malware campaign which is targeting India's co-operative banks using COVID-19 as a bait.

Seqrite, the enterprise arm of IT security firm Quick Heal Technologies, detected the new wave of Adwind Java Remote Access Trojan (RAT) campaign.

Researchers at Seqrite warned that if attackers are successful, they can take over the victim's device to steal sensitive data like SWIFT logins and customer details and move laterally to launch large scale cyberattacks and financial frauds.

According to the researchers, the Java RAT campaign starts with a spear-phishing email which claims to have originated from either the Reserve Bank of India or a nationalised bank.

The content of the email refers to COVID-19 guidelines or a financial transaction, with detailed information in an attachment, which is a zip file containing a JAR based malware.

Upon further investigation, researchers at Seqrite found that the JAR based malware is a Remote Access Trojan that can run on any machine which has Java runtime enabled and hence it can impact a variety of endpoints, irrespective of their base operating system.

Once the RAT is installed, the attacker can take over the victim's device, send commands from a remote machine, and spread laterally in the network.

In addition, this malware can also log keystrokes, capture screenshots, download additional payloads, and extract sensitive user information, Seqrite said, adding that such attack campaigns can effectively jeopardise the privacy and security of sensitive data at the co-operative banks and result in large scale attacks and financial frauds.

To prevent such attacks, users need to exercise ample caution and avoid opening attachments and clicking on web links in unsolicited emails.

Banks should also keep their operating systems updated and have a full-fledged security solution installed on all the devices, Seqrite advised.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 13,2020

New Delhi, Jul 13: The Income Tax Department has facilitated a new functionality for banks and post offices to ascertain TDS applicability rates on cash withdrawal of above Rs 20 lakh in case of a non-filer of the income-tax return and that of above Rs 1 crore in case of a filer of the income-tax return.

In a statement, the Central Board of Direct Taxes (CBDT) said that now banks and post offices have to only enter the PAN of the person who is withdrawing cash for ascertaining the applicable rate of TDS.

So far, more than 53,000 verification requests have been executed successfully on this facility, a statement by the CBDT said.

"CBDT today said that this functionality available as 'Verification of applicability u/s 194N' on www.incometaxindiaefiling.gov.in since 1st July 2020, is also made available to the Banks through web-services so that the entire process can be automated and be linked to the Bank's internal core banking solution," it said.

On entering PAN by the bank or the post office, a message will be instantly displayed on the departmental utility: "TDS is deductible at the rate of 2 per cent if cash withdrawal exceeds Rs 1 crore", in case the person withdrawing cash is a filer of the income-tax return.

In case the person withdrawing cash is a non-filer of income tax return, the message shown would be: "TDS is deductible at the rate of 2 per cent if cash withdrawal exceeds Rs 20 lakh and at the rate of 5 per cent if it exceeds Rs 1 crore."

The CBDT said that the data on cash withdrawal indicated that huge amount of cash is withdrawn by the persons who have never filed income-tax returns.

To ensure filing of return by these persons and to keep track on cash withdrawals by the non-filers, and to curb black money, the Finance Act, 2020 with effect from July 1, 2020 further amended IT Act to lower threshold of cash withdrawal to Rs 20 lakh for the applicability of this TDS for the non-filers and also mandated TDS at the higher rate of 5 per cent on cash withdrawal exceeding Rs 1 crore by the non-filers.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.