Connect with us

Hi, what are you looking for?

HEADLINES

Sophos identifies source of ‘MrbMiner’ attacks targeting database servers

MrbMiner is a recently discovered cryptominer that targets internet-facing database servers (SQL servers) and downloads and installs a cryptominer. Database servers are an attractive target for cryptojackers because they are used for resource intensive activity and therefore have powerful processing capability.

Sophos, a global player in next-generation cybersecurity, published a new report on MrbMiner, “MrbMiner: Cryptojacking to bypass international sanctions,” tracking its origin and management to a small software development company based in Iran. 

MrbMiner is a recently discovered cryptominer that targets internet-facing database servers (SQL servers) and downloads and installs a cryptominer. Database servers are an attractive target for cryptojackers because they are used for resource intensive activity and therefore have powerful processing capability. 

SophosLabs found that the attackers used multiple routes to install the malicious mining software on a targeted server, with the cryptominer payload and configuration files packed into deliberately mis-named zip archive files. 

The name of an Iran-based software company was hardcoded into the miner’s main configuration file. This domain is connected to many other zip files also containing copies of the miner. These zip files have in turn been downloaded from other domains, one of which is mrbftp.xyz. 

Advertisement. Scroll to continue reading.

“In many ways, MrbMiner’s operations appear typical of most cryptominer attacks we’ve seen targeting internet-facing servers,” said Gabor Szappanos, threat research director, SophosLabs. “The difference here is that the attacker appears to have thrown caution to the wind when it comes to concealing their identity. Many of the records relating to the miner’s configuration, its domains and IP addresses, signpost to a single point of origin: a small software company based in Iran.

“In an age of multi-million dollar ransomware attacks that bring organizations to their knees it can be easy to discount cryptojacking as a nuisance rather than a serious threat, but that would be a mistake. Cryptojacking is a silent and invisible threat that is easy to implement and very difficult to detect. Further, once a system has been compromised it presents an open door for other threats, such as ransomware. It is therefore important to stop cryptojacking in its tracks. Look out for signs such as a reduction in computer speed and performance, increased electricity use, devices overheating and increased demands on the CPU.”

Advertisement
Advertisement
Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

Kaspersky has been at the forefront of raising awareness about cybercrimes and empowering individuals and organizations to protect themselves.

HEADLINES

The new investment to build new cloud and AI infrastructure across key international markets also aims to enhance the cloud and AI product suite...

HEADLINES

In a reshaping of its portfolio, ATRAM has rebranded and optimized the newly acquired funds, reflecting a commitment to providing diversified investment options that...

HEADLINES

Under the theme 'Unfolding the Intelligent Future,' ZTE showcased a comprehensive portfolio of ICT products and solutions, featuring 5G wireless, transmission, fixed network, maintenance...

Phones

POCO, a popular technology brand among young tech enthusiasts, is set to redefine the mobile flagship segment with the launch of its new POCO...

MOTORING

One lucky winner will enjoy an all-expenses-paid trip for two to watch Max Verstappen and the Red Bull Racing team at the prestigious Singapore...

HEADLINES

“We remind our customers to carefully inspect URLs before opening them. Criminals often use spellings very close to legitimate domains to deceive customers into...

HEADLINES

AI is transforming business at an unprecedented pace. Data centers must be designed from the ground up to handle AI’s speed and scale while...

Advertisement