New Satan Variants Target Financial Sector With Monero Miners and Ransomware

[PRIBO247]

Researchers spotted two Satan variants targeting
organizations in the financial sector with Monero
miners and ransomware.

The first variant of the malware, which security
solutions provider NSFOCUS spotted in early November,
targets Linux and Windows systems and spreads by
exploiting various application vulnerabilities. After
establishing a foothold into a system, the virus simply
propagates itself further without causing additional
damage.

A few weeks later, NSFOCUS came across a second
variant of Satan that is also capable of self-propagation
via Windows and Linux platforms. But unlike the first
sample, this variant is drops ransomware that encrypts
local files and appends “.lucky” to filenames of affected
assets. It also installs the XMRig Monero miner on
infected machines.

The Evolution of Satan
First reported on by Bleeping Computer in January
2017, Satan entered the digital threat landscape as a
ransomware-as-a-service (RaaS). Its operators have
since updated its capabilities to expand its reach. In
April, Blaze’s Security Blog reported that a Satan
variant had abused the EternalBlue exploit to spread
across vulnerable systems. 360 Total Security later
observed that the threat had added two new system
vulnerabilities to its arsenal.
Satan’s evolution is emblematic of ransomware’s
ongoing prominence as a digital threat. Europol went so
far as to call ransomware “the key malware threat in
both law enforcement and industry reporting” given the
surge in targeted campaigns and attackers’ preference
for ransomware over banking Trojans in financially
motivated malware attacks.

How to Defend Against Satan Variants
Security professionals can help defend the
organizations against Satan variants by patching
software vigilantly and regularly. Investing in endpoint
management technology can also help security teams
gain visibility into users and devices and keep
ransomware off the network proactively.
Finally, organizations should implement an antivirus
solution that is compatible with the Anti Malware
Scanning Interface (AMSI) to protect their networks
from Monero miners and other cryptocurrency-related
threats.

https://securityintelligence.com/news/