Everything You Should Know About The MyKings Botnet

According to a new Sophos Labs research, the MyKings botnet, which has been distributing crypto miners and other malware for three years, is becoming more sophisticated and now employs steganography techniques to conceal malicious code upgrades. For a better understanding, select the cyber security certifications.

The malicious code was discovered by Sophos researchers in an undisclosed public repository, hidden in a JPEG photograph of pop star Taylor Swift. According to the Sophos Lab investigation, MyKings, also known as DarkCloud or Smominru, is using the Windows EternalBlue vulnerability to enable the botnet to propagate over corporate networks.

EternalBlue is a US National Security Agency exploit tool that was published by the Shadow Brokers group in April 2017, giving the WannaCry ransomware its worm-like ability to spread from device to device. Even though Microsoft provided patches for EternalBlue two years ago, many Windows computers are still vulnerable to attack if an exploit for the flaw is developed.

Make Money Quietly

Because the MyKings botnet can propagate cryptominers, Trojan backdoors and other malware, it has been a consistent money maker for its authors. Sophos Labs believes that fraudsters have made roughly $3 million in earnings since 2016, primarily through mining the monero virtual currency, which is presently selling at around $47.

According to the Sophos report, the MyKings gang earns around $300 per day from its operation, a small sum that demonstrates how persistent this botnet has become over the last three years by exploiting unpatched devices and leveraging its ability to scan and exploit unsecured ports, as well as developers using open-source code to add malicious tools. Research cyber security certifications to find out what makes MyKings botnet tick.

Spreading Capability

According to Sophos' study, the MyKings botnet has infected at least 44,000 public-facing IP addresses since 2016, with the malicious network likely being considerably larger. According to an August research by Carbon Black, the botnet may have infected over 500,000 susceptible Windows devices worldwide.

According to Sophos, the botnet primarily targets Windows machines and searches for unprotected and insecure network ports to access. According to the researchers, it can perform brute-force assaults on MY-SQL, MS-SQL, RDP and Telnet. In one instance, the botnet exploited a weakness in a server that oversaw storing data from closed-circuit cameras. If you want to learn more about these exploited data, enroll in a cyber crime course online program.

In the last three years, the MyKings botnet has expanded worldwide, including to the United States, China, Russia, Brazil and Japan. Once inside a device, the MyKings botnet attempts to propagate to additional devices by exploiting the EternalBlue vulnerability. This increases the botnet's overall size. Sophos researchers discovered that MyKings will clear the network of any rival malware to maintain dominance in the compromised network and then block the ports to keep other threat actors out.

The botnet can persist in a network in a variety of ways. According to the Sophos report, one technique is to use a "bootkit." Even if an infection is detected and most of the malicious components are removed from the network, the bootkit will simply relaunch the malware when the device is rebooted and the botnet will restart, according to the researchers.

Acting Fast

In addition, MyKings has begun to experiment with steganography, a process of hiding data within images or data. Over the last two years, threat actors have become more adept at using this strategy. Take a cyber security course to learn more about it. Sophos discovered a botnet update hidden within a JPEG of Taylor Swift in an unknown public repository by the MyKings gang. As part of the upgrade, the researchers discovered a Windows malware executable file including a brute-force tool in the Swift image. According to the researchers, the MyKings operators are attempting to hide the update from security systems distributed across the network by utilizing the Taylor Swift image. so, register for a cyber crime course online right away.

Conclusion

According to Gabor Szappanos, threat research director at Sophos Labs and a co-author of the report, the deployment of steganography combined with exploiting EternalBlue and adding other open-source components to the botnet, demonstrates that the MyKings gang is adept at adopting any new methods that help them increase their attacks and the size of the botnet.