New Monero Botnet Looks Like Last Year's Outlaw Attack

There's another Monero mining botnet that's targeting China.

Recently exposed a URL spreading a botnet that looks suspiciously like one unleashed by the Outlaw hacking group last year.

The Outlaw outfit - a name coined by its discoverers at Trend Micro, who translated "The Romanian word haiduc, the hacking tool the group primarily uses" - is infamous for its previous release.

The new attack, uncovered by Trend Micro's honeypot security systems, has been restricted to computers based in China so far.

Trend Micro estimates that hackers have used crypto-jacking to mine $250,000 per month in Monero.

The Outlaw botnet uses a brute force attack and Secure Shell exploit to give the attackers remote access over victim's systems.

A more detailed report of Outlaw's previous attack showed that once the attackers have access, the malware executes commands to download and install the cryptocurrency miner payload. Additionally, if the malware detects cryptocurrency miners already installed on the system, it will delete them to reduce competition for system resources.

The security experts also noted that the backdoor component is also capable of launching distributed denial-of-service attacks which would allow the cybercriminals to monetize their botnet not only through mining, but by offering DDoS-for-hire services.

They suggest the malware may be laying dormant until future editions of the botnet are released.

To speculate whether the botnet has mined any cryptocurrency or made any successful attacks yet.