Bot Smominru infected more than 500,000 computers with malware for Monero mining

Computer security agencies ensure that the Smominru Bot has the potential to be reactivated in the affected computers, which is why work is being done to permanently suppress it and effectively protect other computers.

Recently published reports indicate that around half a million computers were used without permission from their users by a bot mining company, which generated approximately 9,000 units of the Monero cryptocurrency (total valued at approximately USD $ 3.6 million).

The bot, known as "Smominru", infected more than 526,000 computers with Windows operating system, and was used since May 2017 to mine Monero balances without the authorization of users. The malware makes use of the EternalBlue exploit, which was originally developed by the US National Security Agency (NSA) and leaked by the group of hackers under the alias "Shadow Brokers" last year. This program was later deployed with another exploit developed by the NSA called DoublePulsar, which was used by the WannaCry program.

According to information published by the portal ZDNet, the servers with Windows operating system are perfectly coupled to the Smominru bot since they are always on and have a greater processing capacity than a personal computer. Most of the affected teams are in Russia, India and Taiwan, although many more cases were reported worldwide.

The workers of the computer security agencies Proofpoint, Abuse.ch and ShadowServer Foundation have tried to eradicate the bot mining by doing a technique called "Sinkholing", but it seems that the Smominru malware manages to recover quickly.

Originally the Monero cryptocurrency has always been associated with cyber crimes, since it keeps transactions completely anonymous, the amounts used in each shipment and the history handled by the user.

Keep in mind that last year, the DoublePulsar exploit was used to secretly carry out the installation of a Monero mining malware. Similarly, earlier this week the TrendMicro company announced that illegal mining programs had been used in DoubleClick ads managed by Google, so the company's popular video platform, YouTube, served as the perfect medium. so that many people would make available the resources of their computers in the production of Monero balances without their consent.

                                        Source coindesk