Lucifer Malware Emerges As New Threat To Windows Devices

Lucifer Malware Targeting Windows Researchers from Palo Alto Networks’ Unit 42 division have found an active campaign of new malware in the wild. Dubbed ‘Satan’ by the threat actors, and ‘Lucifer’ by the researchers this malware exploits known bugs to infect Windows machines. Sharing the details in a post, the researchers explained that they caught two strains of Lucifer while analyzing the campaign. Yet, their functionalities predominantly remained the same, version 2 is more advanced. Briefly, Lucifer malware aims at cryptojacking by dropping XMRig on target devices, and DDoS attacks. 

Moreover, the other functionalities are slightly different for the two versions. The Lucifer v.1 performs cryptojacking, DDoS attacks, brute-forcing credentials, and self-propagation. Whereas, Lucifer v.2, in addition to these capabilities, also exhibits anti-sandbox and anti-debugger functionalities. Also, the malware tends to drop EternalBlue, EternalRomance, and DoublePulsar backdoors (under certain circumstances) for propagation. Both Lucifer variants exploit known security flaws in Windows systems to infect target machines. These flaws include CVE-2014-6287, CVE-2017-10271, CVE-2017-9791, PHPStudy Backdoor RCE, CVE-2017-0144, CVE-2017-0145, CVE-2017-8464, CVE-2018-7600, CVE-2018-1000861, ThinkPHP RCE vulnerabilities (CVE-2018-20062), and CVE-2019-9081. Malware Campaign In The Wild The researchers confirmed that they observed two different campaigns involving the malware in the wild. For the first time, they spotted an active campaign on May 29, 2020, that ended on June 10, 2020. Then, from June 11, 2020, the second campaign started off with the advanced malware variant which is still active. Whereas, regarding the vulnerable software, they stated, The vulnerable software includes Rejetto HTTP File Server, Jenkins, Oracle Weblogic, Drupal, Apache Struts, Laravel framework, and Microsoft Windows. Since the campaign exploits all known vulnerabilities, the researchers urged the users to ensure keeping their devices up-to-date. Moreover, they also advise all to set up strong passwords to prevent dictionary attacks. Let us know your thoughts in the comments.

Stay safe and stay protected!