Thousands of enterprise systems infected by new Blue Mockingbird malware gang


Thousands of enterprise systems are believed to have been infected with a cryptocurrency-mining malware operated by a group tracked under the codename of Blue Mockingbird.

Discovered earlier this month by malware analysts from cloud security firm Red Canary, the Blue Mockingbird group is believed to have been active since December 2019.

Researchers say Blue Mockingbird attacks public-facing servers running ASP.NET apps that use the Telerik framework for their user interface (UI) component.

Hackers exploit the CVE-2019-18935 vulnerability to plant a web shell on the attacked server. They then use a version of the Juicy Potato technique to gain admin-level access and modify server settings to obtain (re)boot persistence.

Once they gain full access to a system, they download and install a version of XMRRig, a popular cryptocurrency mining app for the Monero (XMR) cryptocurrency.

Some attacks pivot to internal networks

Red Canary experts say that if the public-facing IIS servers are connected to a company’s internal network, the group also attempts to spread internally via weakly-secured RDP (Remote Desktop Protocol) or SMB (Server Message Block) connections.

In an email interview earlier this month, Red Canary told ZDNet that they don’t have a full view of this botnet’s operations, but they believe the botnet made at least 1,000 infections so far, just from the limited visibility they had.

“Like any security company, we have limited visibility into the threat landscape and no way of accurately knowing the full scope of this threat,” a Red Canary spokesperson told us.

“This threat, in particular, has affected a very small percentage of the organizations whose endpoints we monitor. However, we observed roughly 1,000 infections within those organizations, and over a short amount of time.”

However, Red Canary says the number of companies impacted could be much higher, and even companies who believe to be safe are at risk of attack.

The dangerous Telerik UI vulnerability

This is because the vulnerable Telerik UI component might be part of ASP.NET applications that are running on their latest versions, yet, the Telerik component might be many versions out of date, still exposing companies to attacks.

Many companies and developers may not even know if the Telerik UI component is even part of their applications, which, again, leaves companies exposed to attacks.

And this confusion has been ruthlessly exploited by attacks over the past year, ever since details about the vulnerability became public.

For example, in an advisory published in late April, the US National Security Agency (NSA) listed the Telerik UI CVE-2019-18935 vulnerability as one of the most exploited vulnerabilities used to plant web shells on servers.

In another security advisory published last week, the Australian Cyber Security Centre (ACSC) also listed the Telerik UI CVE-2019-18935 vulnerability as one of the most exploited vulnerabilities to attack Australian organizations in 2019 and 2020.

In many cases, organizations may not have an option to update their vulnerable apps. In these cases, many companies would need to ensure that they block exploitation attempts for CVE-2019-18935 at their firewall level.

In case they don’t have a web firewall, companies need to look for signs of a compromise at the server and workstation level. Here, Red Canary has released a report with indicators of compromise that companies can use to scan servers and systems for signs of a Blue Mockingbird attack.

“As always, our primary purpose in publishing information like this is to help security teams develop detection strategies for threat techniques that are likely to be used against them. In this way, we think that it’s important for security to evaluate their ability to detect things like COR_PROFILER-based persistence and initial access via Telerik vulnerability exploitation,” Red Canary told ZDNet.

About the author

E-Crypto News was developed to assist all cryptocurrency investors in developing profitable cryptocurrency portfolios through the provision of timely and much-needed information. Investments in cryptocurrency require a level of detail, sensitivity, and accuracy that isn’t required in any other market and as such, we’ve developed our databases to help fill in information gaps.

Related Posts

E-Crypto News Executive Interviews

Automated trading with HaasBot Crypto Trading Bots

Crypto Scams

Millions in Cryptocurrency Stolen by Scammers in the Last Month According to Tenable Research
November 24, 2021
Behind The Scenes: How this Crypto Community Responded to + $50m Hack
October 18, 2021
Crypto Scams
Crypto Scams Still Persistent In 2021, SEC Warns About Red Flags To Watch
September 9, 2021
Poly Network
Here’s How Hackers Stole Over $600 million in the Poly Network Attack
August 12, 2021
The World’s Most Infamous Crypto Hacks and Scams
July 31, 2021

Blockchain/Cryptocurrency Questions and Answers

Crypto casinos
How Does Bitcoin Casino Work + 2021 Beginner’s Guide
November 8, 2021
How to Buy and Sell Cryptocurrency
November 8, 2021
What Are Bitcoin Futures And How Will They Work In 2022?
November 4, 2021
The Unconventional Guide to Ethereum
October 28, 2021
ICo Presale
The Science Behind ICO Presales…
October 14, 2021

CryptoCurrencyUSDChange 1hChange 24hChange 7d
Bitcoin54,520 0.37 % 0.80 % 9.26 %
Ethereum4,094.6 0.15 % 1.07 % 7.70 %
Binance Coin595.29 0.01 % 2.27 % 1.69 %
Tether0.9986 0.03 % 0.08 % 0.23 %
Solana189.86 0.00 % 4.04 % 13.04 %
Cardano1.510 0.13 % 4.05 % 21.92 %
XRP0.9264 0.28 % 2.94 % 15.80 %
USD Coin1.000 0.14 % 0.20 % 0.17 %
Polkadot30.87 2.19 % 17.29 % 10.73 %
Dogecoin0.2215 0.68 % 1.42 % 7.23 %

Bitcoin (BTC) $ 54,301.00
Ethereum (ETH) $ 4,088.18
Binance Coin (BNB) $ 596.04
Tether (USDT) $ 1.00
Solana (SOL) $ 190.16
Cardano (ADA) $ 1.50
XRP (XRP) $ 0.92763
USD Coin (USDC) $ 1.00
Polkadot (DOT) $ 33.63
Dogecoin (DOGE) $ 0.200286