X-Industry

coinminer (2)

Shadow Force

11244328498?profile=RESIZE_400xThe Shadow Force group is a threat group that has been active since 2013, targeting corporations and organizations in South Korea.  Trend Micro revealed the first analysis report in September 2015, where it stated that a Korean media-related company had been attacked.  In March 2020, AhnLab published an analysis report on Operation Shadow Force.  It was introduced as a single campaign a there was the possibility of it being activies of an existing threat group.  However, no relevant threat group

Smominru Botnet

Summary Beginning in August of 2017, a new cryptocurrency mining botnet, dubbed Smominru, started propagating via the recently leaked Eternal Blue exploit. Smominru, aka MyKings, is characterized by the targeting of Windows systems using WMI as a file-less persistence mechanism. As of March 2019, Smominru showed no signs of slowing down. Wapack Labs has identified approximately 316K victims connecting to Smominru infrastructure over a period of 6 days. This report provides a high-level overview