SIEM agent being used in SilentCryptoMiner attacks
A global malware campaign targeting mainly Russian-speaking users has been distributing cryptocurrency mining malware through fake software download sites, Telegram channels, and YouTube videos. The multi-stage infection chain uses unusual techniques for persistence and evasion, including hiding malicious payloads in legitimate file signatures and abusing the Wazuh SIEM agent as a backdoor. The final payload injects the SilentCryptoMiner into explorer.exe to mine cryptocurrencies like Monero. The attackers use SEO poisoning, social engineering, and multiple persistence mechanisms to maintain access. While primarily focused on cryptomining, some variants can also steal cryptocurrency wallet addresses and take screenshots.
Pulse ID: 6703a4b33a02dffbd52f2427
Pulse Link: https://otx.alienvault.com/pulse/6703a4b33a02dffbd52f2427
Pulse Author: AlienVault
Created: 2024-10-07 09:06:59
Be advised, this data is unverified and should be considered preliminary. Always do further verification.