Loading story…
Researchers reported that the Lucifer malware evolved from a Windows-based cryptominer into a cross-platform threat targeting Windows, Linux, and IoT devices with a mix of Monero mining, DDoS, command-and-control, and remote execution capabilities. Check Point linked Lucifer to the earlier BlackSquid and Rudeminer/Spreadminer activity through shared code traits and Monero wallet overlaps, indicating the operators had likely been active since 2018 and were continuing to release new variants.
The campaign hit more than 25 organizations across the United States, Ireland, the Netherlands, Turkey, and India, including victims in manufacturing, legal, insurance, and banking. The malware spread by exploiting known flaws—especially CVE-2018-10561 in Dasan GPON routers—along with older Windows exploits and brute-force attacks. Researchers said Linux samples supported mining and full C2 functions, while ARM and MIPS variants were used mainly for DDoS operations, underscoring Lucifer's shift into a broader hybrid malware platform.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The report states that the first samples of the newer Lucifer campaign were uploaded to VirusTotal in February 2020, marking the emergence of the newer campaign iteration.
Check Point reported that samples tied to the Lucifer, BlackSquid, and Rudeminer/Spreadminer-linked campaign date back to late 2018, indicating the operators likely began activity in 2018.
Check Point published research connecting Lucifer to the previously reported BlackSquid and Rudeminer/Spreadminer campaigns through shared Monero wallets, similar samples, and code traits.
ThreatCloud telemetry showed recent Lucifer activity affecting more than 25 organizations in the United States, Ireland, the Netherlands, Turkey, and India across manufacturing, legal, insurance, and banking sectors.
Check Point said the first and only ARM sample noted in the report was uploaded to VirusTotal on May 10. The sample primarily supported DDoS capabilities and was not detected as malicious at the time referenced.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cryptocurrency-mining malware continued to expand across enterprise and consumer environments through multiple delivery channels, including social media, malicious advertising, and compromised IoT devices. Trend Micro reported that **Digmine** spread through Facebook Messenger by posing as a video file, then abusing active Chrome-based Facebook sessions to message additional victims and install a modified `XMRig` Monero miner. Separately, a malvertising campaign abused **Google DoubleClick** to serve hidden **Coinhive** and private web miners on legitimate high-traffic sites, driving a sharp rise in detections while consuming as much as 80% of affected systems’ CPU resources. Researchers also observed an updated **Bashlite** variant targeting IoT devices, particularly systems exposing the **WeMo UPnP API**, adding cryptocurrency-mining, backdoor, DDoS, and device-bricking functions to its botnet activity. The broader threat reflects a long-running pattern in which attackers exploit known vulnerabilities, weak configurations, and trusted platforms to hijack computing resources across desktops, servers, Linux hosts, mobile devices, and IoT systems for illicit mining, while also creating opportunities for persistence, further compromise, and operational disruption.
Aug 21, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Researchers reported that the **Necro** botnet—also tracked as **N3Cr0m0rPh**, **FreakOut**, and **Necromorph**—rapidly evolved from an older Python malware family into an active cross-platform campaign targeting both Linux and Windows systems. Multiple reports tied the operation to exploitation of public-facing flaws including `CVE-2020-28188`, `CVE-2021-3007`, and `CVE-2020-7961`, with later variants adding more n-day exploits such as those affecting TerraMaster, Genexis, Xinuos OpenServer, Zeroshell, and **Visual Tools DVR VX16 4.2.28.0**. The malware also spread through SSH and Telnet brute forcing, and researchers observed infection volumes ranging from hundreds of confirmed download attempts to estimates in the tens of thousands of compromised hosts. The botnet used **IRC-based command and control**, later strengthened with **DGA-generated domains**, **Tor**, **SSL-encrypted communications**, polymorphic code, and PyInstaller-packed binaries to improve resilience and execution. Once installed, Necro enabled **DDoS attacks, reverse shells, persistence, traffic sniffing, ARP poisoning, lateral movement, file infection, and JavaScript injection**, while monetizing access primarily through **XMRig-based Monero mining** and, in some cases, Tezos mining. Cisco Talos also observed a Windows user-mode rootkit and a one-off apparent ransomware delivery attempt, underscoring that the operators were actively adding new payloads and exploit paths as the campaign matured.
Aug 15, 2026