Security News > 2021 > August > Golang Cryptomining Worm Offers 15% Speed Boost

A freshly discovered variant of the Golang crypto-worm was recently spotted dropping Monero-mining malware on victim machines; in a switch-up of tactics, the payload binaries are capable of speeding up the mining process by 15 percent, researchers said.

According to research from Uptycs, the worm scans for and exploits various known vulnerabilities in popular Unix and Linux-based web servers, including CVE-2020-14882 in the Oracle WebLogic Server, and CVE-2017-11610, a remote code-execution bug which affects XML-RPC servers.

The attack begins with a shell script which downloads the worm using the curl utility, researchers noted, adding that the script uses several defense-evasion techniques like firewall altering and disabling monitoring agents.

Once installed, the worm downloads another shell script which downloads a copy of the same Golang worm.

"According to the documentation of XMRig, disabling the hardware prefetcher increases the speed up to 15 percent," researchers said.

In all, the Uptycs team identified seven similar samples of the Golang wormed cryptominer, starting in June.

News URL

https://threatpost.com/golang-cryptomining-worm-speed-boost/168456/