Lucifer

Lucifer is a powerful and relatively new malware variant that combines cryptojacking and DDoS (Distributed Denial of Service) attack capabilities. This malicious software targets Windows platforms, exploiting older vulnerabilities to spread and perform harmful activities. Lucifer is particularly noteworthy for its ability to exchange mining information, demonstrating its robust capabilities. The malware has evolved over time, with version 2 notably adding CVE-2017-8464 to its arsenal and removing CVE-2018-1000861, CVE-2017-10271, and CVE-2017-9791. On March 2, 2024, a significant development occurred when a new variant of the Lucifer DDoS botnet malware was identified. This variant specifically targeted Apache Hadoop and Apache Druid servers, putting organizations leveraging Apache's big-data solutions at risk. The attackers exploited known misconfigurations and vulnerabilities in these open-source platforms to download and execute the malware, storing it in the Hadoop YARN instance's local directory. The Lucifer malware campaign has been ongoing for at least six months as of early 2024, marked by three unique attack phases. These phases involve exploiting vulnerabilities to deliver the payload, initiating the download of Lucifer, and executing the malware. The persistence and evolution of the Lucifer malware highlight its potential to cause significant disruption and damage, warranting close attention from cybersecurity professionals.