Monero [XMR] Mining Malware in Action with Drupal Vulnerability Exploitation

By Sagar Saxena
Published June 22, 2018 Updated June 22, 2018
Best Buy In

DeFi Platform



monero mining malware
Source: CCN

Monero [XMR] Mining Malware in Action with Drupal Vulnerability Exploitation

By Sagar Saxena
Published June 22, 2018 Updated June 22, 2018

Hackers are exploiting the Drupal vulnerability to attack the networks and activate Monero (XMR) mining malware. The same vulnerability that has been patched in April, is yet again exploited.

Hackers exploiting Drupal vulnerability again

Privacy-focused Monero is certainly favourable among the cybercriminals as yet again the criminals are trying to drop the Monero mining malware into the vulnerable systems by leveraging the Drupal vulnerability. A security flaw CVE-2018-7602 has been found in Drupal, a content management framework that has been exploited. The attackers are trying to run the affected systems into Monero mining bots. These attacks can lead to a number of threats apart from slowing the system performance and stealing the resources.

This is not the first time the Drupal vulnerability has been exploited, back in April, this year only it has been patched. A remote code execution, CVE-2018-7602 affects the 7 and 8 version of Drupal. In order to exploit this vulnerability, a shell script has been downloaded that recovers an  Executable and Linkable Format-based (ELF) downloader. This then adds a crontab entry that basically updates itself automatically.

Also, read: Monero (XMR), Siacoin (SC), NEM (XEM) & Aeternity (AE) Gets New Listing, Price Analysis

Save your systems

During the process, it retrieves and installs a Monero mining application in the affected machine. A modified version of XMRig, it is one of the most commonly used variants in Monero mining attacks. Apparently, the downloader even checks the target system to see if it the machine to be compromised or not. Once miner starts running, it even changes its name.

The attacks aren’t running amok, they take proper precautions by hiding behind the Tor network. Reportedly, the same IP address has initiated 810 attacks that have been blocked by Trend Micro. However, it’s not confirmed if all of these attacks are Monero related or not. Apparently, this IP address exploits Heartbleed (CVE-2014-0160), ShellShock (CVE-2014-6271) memory leak flaw in Apache (CVE-2004-0113), WEB GoAhead (CVE-2017-5674) and others.

By patching and updating the Drupal core, one can fix this vulnerability for which the guidelines are provided on the security bulletin of Drupal.

What do you think of the repeated attempts by cybercriminals to activate Monero mining malware? Share your thoughts with us!


The presented content may include the personal opinion of the author and is subject to market condition. Do your market research before investing in cryptocurrencies. The author or the publication does not hold any responsibility for your personal financial loss.
About Author
Sagar Saxena
218 Articles
Passionate about Blockchain and has been researching and writing about the Blockchain technology for over a year now. Also holds expertise in digital marketing. follow me on twitter at @sagar2803 or reach out to him at sagar[at]

Loading Next Story