Partnered With:

KingMiner has taken control of tens of thousands of servers

Read this article in 5 Minutes

KingMiner is a Monroe - dollar mining Trojan for blasting attacks against Windows server MS SQL

Block beat BlockBeats news, tencent security yujian threat intelligence center detected KingMiner variant attack, KingMiner is a Windows server MS SQL blasting attack menlo mining Trojan. The Trojan first appeared in mid-june 2018, and two improved versions were quickly released. Attackers use a variety of evasive techniques to bypass the virtual machine environment and security detection, resulting in some anti-virus engines unable to detect accurately.

The current version of KingMiner has the following features:

1. Blasting attack and invasion against MSSQL;

2. Persistent attack with WMI timer and Windows scheduling task;

3. Shut down the RDP service on the machine with cve-2019-0708 vulnerability to prevent other mining groups from intruding to monopolize server resources for mining;

4. Use base64 and specific encoding of XML, TXT, PNG files to encrypt the Trojan;

5. Use the signature file of Microsoft and several well-known manufacturers as the parent process, "white + black" start the Trojan DLL.

KingMiner affected more than 10, 000 computers, with guangdong, chongqing, Beijing and Shanghai among the worst affected, according to tencent's security yujian threat intelligence center.

Safety recommendations

Tencent yujian suggests that enterprises take specific defensive measures against the technical characteristics of KingMiner mining Trojan:

1. Fix privilege promotion vulnerability cve-2019-0803 according to Microsoft official announcement:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803

2. Consolidate SQL Server and fix security vulnerabilities of the Server. Use a secure password policy, use strong passwords, do not continue to use weak passwords, especially sa account password, to prevent hackers from cracking violence.

3. Modify the default port of SQL Sever service, change the default port 1433 setting based on the original configuration, and set access rules to reject port 1433 probes.

4. Enterprise users can deploy tencent yudian terminal security management system on the server to prevent such attacks.

5. Recommend enterprises to use tencent yujie advanced threat detection system to detect various suspicious attacks by unknown hackers. Yujie advanced threat detection system is a unique threat intelligence and malicious detection model system developed based on the security capability of tencent anti-virus laboratory and tencent's massive data in the cloud and terminal. (https://s.tencent.com/product/gjwxjc/index.html)