Lucifer Malware Expanded Into Cross-Platform Cryptojacking and DDoS Attacks

Researchers reported that the Lucifer malware evolved from a Windows-based cryptominer into a cross-platform threat targeting Windows, Linux, and IoT devices with a mix of Monero mining, DDoS, command-and-control, and remote execution capabilities. Check Point linked Lucifer to the earlier BlackSquid and Rudeminer/Spreadminer activity through shared code traits and Monero wallet overlaps, indicating the operators had likely been active since 2018 and were continuing to release new variants.

The campaign hit more than 25 organizations across the United States, Ireland, the Netherlands, Turkey, and India, including victims in manufacturing, legal, insurance, and banking. The malware spread by exploiting known flaws—especially CVE-2018-10561 in Dasan GPON routers—along with older Windows exploits and brute-force attacks. Researchers said Linux samples supported mining and full C2 functions, while ARM and MIPS variants were used mainly for DDoS operations, underscoring Lucifer's shift into a broader hybrid malware platform.