A new aggressive form of cryptomining malware has been discovered in a midsized company with features that alarmed those who discovered it.

Detailed today by the Varonis Security Research team, the cryptomining malware dubbed “Norman” uses various techniques to hide and avoid discovery. It also deploys an interactive “web shell” that may open the door to subsequent malware infections and data theft.

In the case of the unnamed company, almost every server and workstation on the company’s network was found to be infected by Norman. The malware relies on variants of the free DuckDNS dynamic DNS service for command-and-control communications and with some variants used it to pull configuration settings or send updates.

An XMRig-based cryptominer, Norman, like many before it mines for Monero, the cryptocurrency of choice among cryptomining scripts thanks to its anonymity. Where it varies from others is its origin. The researchers believe that it was coded in a French-speaking country as notes in the code were written in French and the French version of WinRAR was used in the creation of the malware file as well.

“Malware that relies on commands from C&C servers to operate are a different type of threat than the average virus,” the researchers said. “Their actions will not be as predictable and will likely resemble the actions of a manual attack” or penetration tester. As a result, they said, “detecting these attacks will be a bit more difficult than running an AV scan.”

Network administrators and computer users are advised to keep all software up-to-date to reduce the ability of attackers to exploit known vulnerabilities and also monitor data access and network traffic. “By using a firewall or proxy, it is possible to detect and block malicious communication to C&C servers, thus preventing the attacker from executing commands or extracting data,” the researchers noted.

Photo: Marco Verch/Flickr