Microsoft Warns of LemonDuck Malware Targeting Windows and Linux Systems

An infamous cross-platform crypto-mining malware has continued
to refine and improve upon its techniques to strike both Windows
and Linux operating systems by setting its sights on older
vulnerabilities, while simultaneously latching on to a variety of
spreading mechanisms to maximize the effectiveness of its
campaigns.

“LemonDuck, an actively updated and robust malware that’s
primarily known for its botnet and cryptocurrency mining
objectives, followed the same trajectory when it adopted more
sophisticated behavior and escalated its operations,” Microsoft
said^[1]
in a technical write-up published last week. “Today, beyond using
resources for its traditional bot and mining activities, LemonDuck
steals credentials, removes security controls, spreads via emails,
moves laterally, and ultimately drops more tools for human-operated
activity.”

The malware is notorious for its ability to propagate rapidly
across an infected network to facilitate information theft and turn
the machines into cryptocurrency mining bots by diverting their
computing resources to illegally mine cryptocurrency. Notably,
LemonDuck acts as a loader for follow-on attacks that involve
credential theft and the installation of next-stage implants that
could act as a gateway to a variety of malicious threats, including
ransomware.

LemonDuck’s activities were first spotted in China in May 2019,
before it began adopting COVID-19-themed lures^[2]
in email attacks in 2020 and even the recently addressed “ProxyLogon^[3]” Exchange Server flaws^[4]
to gain access to unpatched systems. Another tactic of note is its
ability to erase “other attackers from a compromised device by
getting rid of competing malware and preventing any new infections
by patching the same vulnerabilities it used to gain access.”

Attacks incorporating LemonDuck malware have been primarily
focused on the manufacturing and IoT sectors, with the U.S, Russia,
China, Germany, the U.K., India, Korea, Canada, France, and Vietnam
witnessing the most encounters.

Additionally, Microsoft outed the operations of a second entity
that relies on LemonDuck for achieving “separate goals”, which the
company codenamed “LemonCat.” The attack infrastructure associated
with the “Cat” variant is said to have emerged in January 2021,
ultimately leading to its use in attacks exploiting vulnerabilities
targeting Microsoft Exchange Server. Subsequent intrusions taking
advantage of the Cat domains resulted in backdoor installation,
credential, and data theft, and malware delivery, often a Windows
trojan called Ramnit^[5].

“The fact that the Cat infrastructure is used for more dangerous
campaigns does not deprioritize malware infections from the Duck
infrastructure,” Microsoft said. “Instead, this intelligence adds
important context for understanding this threat: the same set of
tools, access, and methods can be re-used at dynamic intervals, to
greater impact.”