Barracuda Researchers Detail LemonDuck Malware Campaign Hijacking Endpoints for Cryptomining

Executive Summary

Barracuda researchers have observed a recent campaign deploying the LemonDuck malware, a botnet that specializes in resource hijacking for cryptocurrency mining. The malware spreads laterally across networks by exploiting vulnerabilities and brute-forcing credentials, then uses infected endpoints' CPU and GPU resources to mine cryptocurrency for the attackers. The observed campaign utilized hidden PowerShell scripts to download additional payloads and maintain communication with its command-and-control (C2) infrastructure. Separately, the report highlights a significant 55% surge in password-spraying attacks originating from Iran, specifically targeting Fortigate VPNs, indicating a broader trend of attacks against remote access infrastructure.

Threat Overview

• Malware: LemonDuck, a cryptomining botnet.
• Primary Objective: Resource Hijacking (T1496 - Resource Hijacking). The malware uses the computational power of infected systems to mine cryptocurrency, generating profit for the operators.
• Propagation: Spreads across networks by exploiting exposed services, using weak credentials, and leveraging known vulnerabilities.
• Execution: Employs PowerShell scripts to download and execute malicious code, often in a hidden or fileless manner to evade detection.

While cryptomining is the primary goal, a botnet like LemonDuck also provides a persistent foothold in a network, which can be sold or repurposed for other malicious activities, such as deploying ransomware or launching DDoS attacks.

Technical Analysis

The LemonDuck campaign observed by Barracuda's SOC demonstrated several key TTPs:

1. Initial Access: LemonDuck is known to gain initial access through various methods, including exploiting vulnerabilities like those in Microsoft Exchange (ProxyLogon) or brute-forcing credentials for services like SMB and RDP.
2. Execution and Persistence: Upon gaining access, the malware executes PowerShell scripts. These scripts are often obfuscated and run with parameters like -WindowStyle Hidden to conceal their activity from the user. The scripts are responsible for downloading the main mining payload and other malicious modules.
3. Command and Control: The infected endpoint establishes communication with a C2 server. This allows the operators to update the malware, change the cryptocurrency being mined, or assign new tasks to the botnet.
4. Lateral Movement: LemonDuck has worm-like capabilities, actively scanning the local network for other vulnerable systems to infect, thereby growing the botnet.

The separate finding of increased password-spraying attacks from Iran against Fortigate VPNs highlights a parallel threat. Attackers are systematically attempting to breach corporate networks by guessing common passwords for a large number of user accounts (T1110.003 - Password Spraying). A successful VPN compromise provides a direct entry point for deploying malware like LemonDuck.

Impact Assessment

While often considered less severe than ransomware, a LemonDuck infection can have significant business impacts:

• Performance Degradation: The constant cryptomining activity consumes significant CPU and GPU resources, leading to severe performance degradation of workstations and servers. This can disrupt business applications and reduce employee productivity.
• Increased Costs: For cloud-based infrastructure, the increased CPU usage can lead to substantially higher electricity and computing bills.
• Security Risk: The botnet provides a backdoor into the network. The operators could use this access to deploy more destructive malware, such as ransomware, at any time.
• Network Saturation: The malware's lateral movement scanning can create excessive network traffic, potentially impacting network performance.

IOCs — Directly from Articles

No specific technical indicators of compromise were provided in the summarized articles.

Cyber Observables — Hunting Hints

To hunt for LemonDuck and similar cryptomining threats, security teams should look for:

Detection & Response

1. Performance Monitoring: Implement performance monitoring for all endpoints and servers. Configure alerts for any system exhibiting sustained high CPU usage (e.g., >90% for more than 30 minutes). This is a key part of D3FEND's Process Analysis (D3-PA).
2. PowerShell Logging: Enable enhanced PowerShell logging (Script Block Logging and Module Logging) to capture the full content of executed scripts, even if they are obfuscated or fileless.
3. Network Egress Filtering: Block outbound traffic to known cryptocurrency mining pool domains and ports at the firewall. This is an application of Outbound Traffic Filtering (D3-OTF).

Mitigation

1. Patch Management: Aggressively patch vulnerabilities in internet-facing systems and common applications to prevent initial access. This aligns with M1051 - Update Software.
2. Strong Password Policies and MFA: Enforce strong, unique passwords for all accounts and mandate MFA for all remote access (VPNs) and administrative interfaces. This directly counters password spraying and brute-force attacks and is a key control under M1027 - Password Policies and M1032 - Multi-factor Authentication.
3. Endpoint Hardening: Restrict the use of PowerShell for standard users where it is not required for their job function. This is a form of M1028 - Operating System Configuration.