Threat group FreakOut’s Necro botnet has developed a new trick: infecting Visual Tools DVRs with a Monero miner. Juniper Threat Labs researchers have issued a report detailing new activities from FreakOut, also known as Necro Python and Python.IRCBot. In late September, the team noticed that the botnets started to target Visual Tools DVR VX16 126.96.36.199 models with cryptomining attacks. The devices are typically deployed as part of a professional-quality surveillance system. A command injection vulnerability was found in the same devices last July. Visual Tools has not yet responded to Threatpost’s request for comment. “The script can run in both Windows and Linux environments,” the Juniper report said. “The script has its own polymorphic engine to morph itself every execution which can bypass signature-based defenses. This works by reading every string in its code and encrypting it using a hardcoded key.” FreakOut has been on the scene since at least January, exploiting recently identified and unpatched vulnerabilities to launch distributed denial-of-service (DDoS) and cryptomining attacks. Juniper reports that the threat actors have developed several iterations of the Necro bot, making steady improvements in its performance and persistence over the past several months. “We have noted a few changes on this bot from the previous version,” the report said. “First, it removed the SMB scanner which was observed in the May 2021 attack. Second, it changed the url that it…
https://govanguard.com/wp-content/uploads/2018/04/Header_Logo.png 0 0 govanguard https://govanguard.com/wp-content/uploads/2018/04/Header_Logo.png govanguard2021-10-13 16:17:002021-10-13 16:17:00FreakOut Botnet Turns DVRs Into Monero Cryptominers
Our Standard Office Hours
Monday – Friday: 8:00AM – 5:00PM EDT
Saturday – Sunday: Closed
Where to Find Us
Data Privacy Notice
- – All product names, logos, and brands are property of their respective owners.
- – The use of these names, logos, and brands is for identification purposes only and does not imply endorsement.
- – Content syndication and aggregation of public information is solely for the purpose of identifying information security trends, all syndicated content contains source links to the content creator website. All content is owned by it’s respective content creators.
- – If you are an owner of some content and want it to be removed, please email email@example.com