{"id":171576,"date":"2019-09-19T00:30:01","date_gmt":"2019-09-18T21:30:01","guid":{"rendered":"http:\/\/ww-vb.mine.nu\/w108\/meet-panda-an-illicit-cryptocurrency-mining-crew-terrorizing-organizations-worldwide\/"},"modified":"2019-09-19T00:30:05","modified_gmt":"2019-09-18T21:30:05","slug":"meet-panda-an-illicit-cryptocurrency-mining-crew-terrorizing-organizations-worldwide","status":"publish","type":"post","link":"https:\/\/hameed.nwar.uk\/sa\/meet-panda-an-illicit-cryptocurrency-mining-crew-terrorizing-organizations-worldwide\/","title":{"rendered":"Meet Panda, a bootleg cryptocurrency mining crew terrorizing organizations worldwide"},"content":{"rendered":"

[ad_1]
\n<\/p>\n

\n

Cybersecurity researchers have profiled a hacking crew named \u201cPanda\u201d believed to have amassed roughly $90,000 price of cryptocurrency by way of distant entry instruments (RATs) and illicit mining malware.<\/p>\n

The Cisco Talos Intelligence Group famous that whereas Panda<\/em> isn\u2019t precisely subtle, it has continued as one of many web\u2019s most energetic attackers in recent times.<\/p>\n

Talos researchers highlighted\u00a0the group\u2019s willingness to constantly exploit susceptible internet purposes worldwide as key to its success. By October final 12 months, a configuration file featured in Panda malware had been downloaded greater than 300,000 instances.<\/p>\n

\u201cIn addition they often replace their focusing on, utilizing a wide range of exploits to focus on a number of vulnerabilities, and is fast to start out exploiting recognized vulnerabilities shortly after public POCs turn out to be obtainable, turning into a menace to anybody gradual to patch,\u201d stated the agency.<\/p>\n

Panda has an enormous bag of RATs (and different exploits)<\/h2>\n

Panda<\/em>\u00a0was first detected in mid-2018 through the wildly profitable \u201cMassMiner\u201d marketing campaign. This was powered by a\u00a0worm which leveraged a number of in-built exploits, and even brute-forced entry to Microsoft SQL servers, to mine the choice cryptocurrency Monero (XMR).<\/p>\n

Now, Panda reportedly makes use of Mimikatz, an open-source program for stealing delicate info from compromised techniques, equivalent to usernames and passwords.<\/p>\n

\"\"
<\/a>\u2026 and it\u2019s nonetheless evolving!<\/figcaption><\/figure>\n

Researchers additionally discovered Panda operates with exploits beforehand utilized by Shadow Brokers, a hacking crew that gained its popularity by publishing info taken from the US Nationwide Safety Company.<\/p>\n

Thus far, Talos has confirmed that Panda has hit organizations within the banking, transportation, telecommunications, IT companies, and healthcare industries.<\/p>\n

This cryptocurrency mining crew could possibly be of Chinese language origin<\/h2>\n

Whoever is behind\u00a0Panda<\/em>\u00a0doesn\u2019t actually care\u00a0an excessive amount of<\/em> about operational safety. For instance, the group acquired its title as one associated area had been registered to a Chinese language-speaking actor who glided by the title \u201cPanda.\u201d<\/p>\n

An analyzed malware pattern additionally requested\u00a0knowledge utilizing an\u00a0IP geolocation service which offered the machine\u2019s IP handle and site in Chinese language.<\/p>\n

Much more curious, Talos analysts discovered Panda had been exploiting a vulnerability within the ThinkPHP internet framework to unfold its malware. Researchers report this software program is especially common in China.<\/p>\n

\u201cPanda\u2019s operational safety stays poor, with a lot of their outdated and present domains all hosted on the identical IP and their TTPs remaining comparatively related all through campaigns,\u201d wrote the agency. \u201cThe payloads themselves are additionally not very subtle.\u201d<\/p>\n

Nonetheless, Panda\u2019s efforts are stated generated round 1,215 XMR in earnings, which at the moment is price round $90,000\u00a0\u2014<\/span> however the precise quantity earned depends on once they offered their cryptocurrency.<\/p>\n

That\u2019s one prolific hacking panda.<\/p>\n

\n Printed September 18, 2019 \u2014 12:12 UTC\n <\/p>\n<\/p><\/div>\n