A giant botnet is forcing Windows servers to mine cryptocurrency

The Smominru miner has infected at least half a million machines - mostly consisting of Windows servers - and spreads via the EternalBlue exploit.

The Smominru miner botnet turns infected machines into miners of the Monero cryptocurrency and is believed to have made its owners around $3.6 million since it started operating in May 2017 - about a month after EternalBlue leaked and around the same time as the WannaCry attack.

While it isn't uncommon for cybercriminals to leverage the power of hijacked networks of computers to acquire cryptocurrencies, this particular network is significant in its individual size - double that of the Adylkuzz mining botnet.

Researchers at Proofpoint say the botnet was made up of 526,000 nodes at its peak - and despite efforts to take it down, the botnet is particularly resilient and keeps regenerating itself and therefore remains a powerful Monero mining tool for its operators.

http://www.zdnet.com/article/a-giant-botnet-is-forcing-windows-servers-to-mine-cryptocurrency/?loc=newsletter_large_thumb_featured&ftag=TRE-03-10aaa6b&bhid=20473959477620286970641095263950