Security researchers discover malware that infected 90,000 computers worldwide

Agencies
October 8, 2019

Security researchers have discovered that the Smominru malware infected 90,000 machines worldwide during the month of August, with an infection rate of up to 4,700 computers per day.

In its post-infection phase, it steals victim credentials, installs a Trojan module and a cryptominer and propagates inside the network, according to researchers from Guardicore, a data centre and cloud security company.

The botnet uses several methods to propagate, but primarily it infects a system in one of two ways -- either by brute-forcing weak credentials for different Windows services, or more commonly by relying on the infamous EternalBlue exploit, cybersecurity firm Kaspersky said in a blog post last week.

Even though Microsoft patched the vulnerability EternalBlue exploits, which made the WannaCry and NotPetya outbreaks possible, many companies are simply ignoring updates, Kaspersky said.

China, Taiwan, Russia, Brazil and the US have seen the most attacks, but that doesn't mean other countries are out of its scope. For example, the largest network Smominru targeted was in Italy, with 65 hosts infected.

The criminals involved are not too particular about their targets, which range from universities to healthcare providers.

However, one detail is very consistent. About 85 per cent of infections occur on Windows 7 and Windows Server 2008 systems. The rest include Windows Server 2012, Windows XP and Windows Server 2003.

After compromising the system, Smominru creates a new user, called admin$, with admin privileges on the system and starts to download a whole bunch of malicious payloads.

The most obvious objective is to silently use infected computers for mining cryptocurrency (namely, Monero) at the victim's expense.

The malware also downloads a set of modules used for spying, data exfiltration, and credential theft.

On top of that, once Smominru gains a foothold, it tries to propagate further within the network to infect as many systems as possible.

To protect their network, computers, and data from Smominru, users need to update operating systems and other software regularly, Kaspersky said.

It is also important for users to use strong passwords. A reliable password manager that helps you create, manage, and automatically retrieve and enter passwords may help protect you against brute-force attacks.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
News Network
May 30,2020

May 30: Patients undergoing surgery after contracting the novel coronavirus are at an increased risk of postoperative death, according to a new study published in The Lancet journal which may lead to better treatment guidelines for COVID-19.

In the study, the scientists, including those from the University of Birmingham in the UK, examined data from 1,128 patients from 235 hospitals from a total of 24 countries.

Among COVID-19 patients who underwent surgery, they said the death rates approach those of the sickest patients admitted to intensive care after contracting the virus.

The scientists noted that SARS-CoV-2 infected patients who undergo surgery, experience substantially worse postoperative outcomes than would be expected for similar patients who do not have the infection.

According to the study, the 30-day mortality among these patients was nearly 24 per cent.

The researchers noted that mortality was disproportionately high across all subgroups, including those who underwent elective surgery (18.9 per cent), and emergency surgery (25.6 per cent).

Those who underwent minor surgery, such as appendicectomy or hernia repair (16.3 per cent), and major surgery such as hip surgery or for colon cancer also had higher mortality rates (26.9 per cent), the study said.

According to the study, the mortality rates were higher in men versus women, and in patients aged 70 years or over versus those aged under 70 years.

The scientists said in addition to age and sex, risk factors for postoperative death also included having severe pre-existing medical problems, undergoing cancer surgery, undergoing major procedures, and undergoing emergency surgery.

"We would normally expect mortality for patients having minor or elective surgery to be under 1 per cent, but our study suggests that in SARS-CoV-2 patients these mortality rates are much higher in both minor surgery (16.3%) and elective surgery (18.9%)," said study co-author Aneel Bhangu from the University of Birmingham.

Bhangu said these mortality rates are greater than those reported for even the highest-risk patients before the pandemic.

Citing an example from the 2019 UK National Emergency Laparotomy Audit report, he said the 30-day mortality was 16.9 per cent in the highest-risk patients.

Based on an earlier study across 58 countries, Bhangu said the 30-day mortality was 14.9 per cent in patients undergoing high-risk emergency surgery.

"We recommend that thresholds for surgery during the SARS-CoV-2 pandemic should be raised compared to normal practice," he said.

"For example, men aged 70 years and over undergoing emergency surgery are at particularly high risk of mortality, so these patients may benefit from their procedures being postponed," Bhangu added.

The study also noted that patients undergoing surgery are a vulnerable group at risk of SARS-CoV-2 exposure in hospital.

It noted that the patients may also be particularly susceptible to subsequent pulmonary complications, due to inflammatory and immunosuppressive responses to surgery and mechanical ventilation.

The scientists found that overall in the 30 days following surgery 51 per cent of patients developed a pneumonia, acute respiratory distress syndrome, or required unexpected ventilation.

Nearly 82 per cent of the patients who died had experienced pulmonary complications, the researchers said.

"Worldwide an estimated 28.4 million elective operations were cancelled due to disruption caused by COVID-19," said co-author Dmitri Nepogodiev from the University of Birmingham.

"Our data suggests that it was the right decision to postpone operations at a time when patients were at risk of being infected with SARS-CoV-2 in hospital," Nepogodiev said.

According to the researchers, there's now an urgent need for investment by governments and health providers in to measures which ensure that as surgery restarts patient safety is prioritised.

They said this includes the provision of adequate personal protective equipment (PPE), establishment of pathways for rapid preoperative SARS-CoV-2 testing, and consideration of the role of dedicated 'cold' surgical centres.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
May 19,2020

Cybersecurity researchers on Monday warned of a Trojan malware campaign which is targeting India's co-operative banks using COVID-19 as a bait.

Seqrite, the enterprise arm of IT security firm Quick Heal Technologies, detected the new wave of Adwind Java Remote Access Trojan (RAT) campaign.

Researchers at Seqrite warned that if attackers are successful, they can take over the victim's device to steal sensitive data like SWIFT logins and customer details and move laterally to launch large scale cyberattacks and financial frauds.

According to the researchers, the Java RAT campaign starts with a spear-phishing email which claims to have originated from either the Reserve Bank of India or a nationalised bank.

The content of the email refers to COVID-19 guidelines or a financial transaction, with detailed information in an attachment, which is a zip file containing a JAR based malware.

Upon further investigation, researchers at Seqrite found that the JAR based malware is a Remote Access Trojan that can run on any machine which has Java runtime enabled and hence it can impact a variety of endpoints, irrespective of their base operating system.

Once the RAT is installed, the attacker can take over the victim's device, send commands from a remote machine, and spread laterally in the network.

In addition, this malware can also log keystrokes, capture screenshots, download additional payloads, and extract sensitive user information, Seqrite said, adding that such attack campaigns can effectively jeopardise the privacy and security of sensitive data at the co-operative banks and result in large scale attacks and financial frauds.

To prevent such attacks, users need to exercise ample caution and avoid opening attachments and clicking on web links in unsolicited emails.

Banks should also keep their operating systems updated and have a full-fledged security solution installed on all the devices, Seqrite advised.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
February 17,2020

Google on Monday announced it is gradually winding down its free public Wi-Fi Station programme currently available at over 400 railway stations in India, and will work with the Indian Railways and Railtel Corporation to help them with existing sites so they can remain useful resources for people.

Google launched its Station initiative in India in 2015 to bring fast, free public Wi-Fi to over 400 of the busiest railway stations in the country by mid-2020.

"We crossed that number by June 2018 and implemented Station in thousands of other locations around the country in partnership with telecommunications companies, ISPs and local authorities," Caesar Sengupta, Vice President, Payments and Next Billion Users, Google, said in a statement.

"Over time, partners in other countries asked for Station too and we responded accordingly. We're grateful for these partnerships, especially with the Indian Railways and the Government of India, that helped us serve millions of users over the last few years," he added.

According to Google, the decision to shut Station has been taken keeping the affordable mobile data plans and mobile connectivity in mind that is improving globally including in India.

"India, specifically now has among the cheapest mobile data per GB in the world, with mobile data prices having reduced by 95 per cent in the last 5 years, as per TRAI in 2019," said Sengupta.

The Indian users consume close to 10GB of data, each month, on average, according to reports.

"Our commitment to supporting the next billion users remains stronger than ever, from continuing our efforts to make the internet work for more people and building more relevant and helpful apps and services," Sengupta noted.

Global networking giant Cisco last year teamed up with Google to roll out free, high-speed public Wi-Fi access globally, starting with India.

The first pilot under the partnership was rolled out at 35 locations in Bengaluru.

Sengupta said that in addition to the changed context, the challenge of varying technical requirements and infrastructure among our partners across countries has also made it difficult for Station to scale and be sustainable, especially for our partners.

"And when we evaluate where we can truly make an impact in the future, we see greater need and bigger opportunities in building products and features tailored to work better for the next billion user markets," he said.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.