Smominru botnet attacks outdated Windows systems with EternalBlue

Active since 2017, Smominru has now become one of the most rapidly spreading computer malware, according to a publicly available report. In 2019, during August alone, it infected 90,000 machines worldwide, with an infection rate of up to 4,700 сcomputers per day. China, Taiwan, Russia, Brazil, and the US have seen the most attacks, but that doesn’t mean other countries are out of its scope. For example, the largest network Smominru targeted was in Italy, with 65 hosts infected.

How the Smominru botnet propagates

The criminals involved are not too particular about their targets, which range from universities to healthcare providers. However one detail is very consistent: About 85% of infections occur on Windows 7 and Windows Server 2008 systems. The rest include Windows Server 2012, Windows XP and Windows Server 2003.

Approximately one-fourth of the affected machines were infected again after Smominru was removed from them. In other words, some victims did clean their systems but ignored the root cause.

That leads to the question: What is the root cause? Well, the botnet uses several methods to propagate, but primarily it infects a system in one of two ways: either by brute-forcing weak credentials for different Windows services, or more commonly by relying on the infamous EternalBlue exploit.

Even though Microsoft patched the vulnerability EternalBlue exploits, which made the WannaCry and NotPetya outbreaks possible, in 2017 even for discontinued systems, many companies are simply ignoring updates.

The Smominru botnet in action

After compromising the system, Smominru creates a new user, called admin$, with admin privileges on the system and starts to download a whole bunch of malicious payloads. The most obvious objective is to silently use infected computers for mining cryptocurrency (namely, Monero) at the victim’s expense.

However, that’s not it: The malware also downloads a set of modules used for spying, data exfiltration, and credential theft. On top of that, once Smominru gains a foothold, it tries to propagate further within the network to infect as many systems as possible.

An interesting detail: The botnet is fiercely competitive and kills any rivals it finds on the infected computer. In other words, it not only disables and blocks any other malicious activities running on the targeted device, but also prevents further infections by competitors.

Attack infrastructure

The botnet relies on more than 20 dedicated servers, mostly located in the US, though some are hosted in Malaysia and Bulgaria. Smominru’s attack infrastructure being so widely distributed, complex, and highly flexible makes it unlikely to be taken down easily, so it seems the botnet will be active for quite some time.

How to protect your network, computers, and data from Smominru:

• Update operating systems and other software regularly.
• Use strong passwords. A reliable password manager helps you create, manage, and automatically retrieve and enter passwords. That will protect you against brute-force attacks.
• Use a reliable security solution.