Skip to main content

Blue Mockingbird Cryptocurrency Campaign

Beginning in December 2019, Blue Mockingbird is a cryptocurrency mining group and campaign targeting exposed ASP.NET web servers.

Threat ID:
CC-3478
Category:
Threat Severity:
Low
Threat Vector:
Published:
28 May 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Beginning in December 2019, Blue Mockingbird is a cryptocurrency mining group and campaign targeting exposed ASP.NET web servers.

Affected platforms

The following platforms are known to be affected:

  • Progress Telerik UI for ASP.NET AJAX - Versions 2019.3.1023 and earlier

Threat details

Blue Mockingbird attacks begin with identification of vulnerable versions of the Telerik UI running on public-facing ASP.NET systems. An exploit is then deployed to install a web shell on the targeted system, before using the Juicy Potato technique to provide it with administration privileges. Once this is done, Blue Mockingbird log into the shell to install copy of the XMRig mining application. They may also attempt to propagate to other systems over RDP or SMB if possible.

For further information:

Remediation steps

Type Step

Telerik address the vulnerability exploited by Blue Mockingbird in their UI for ASP.NET AJAX R1 2020 release. Affected organisations are encouraged to apply this update immediately.

Additionally, to prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Main indicators

SHA256 File Hashes

  • 018a02fd0dbc63e54656b8915d71cd8a2ce4409608ae4dff6ec196ffa8743ba1
  • 14e3c16ca940244bea9b6080fa02384ebb4818572cef7092f90d72ae210b330d
  • 1d30d3cafdcc43b2f9a593983ad096c2c3941025fb4e91257e2dcf0919ed24ba
  • 5377c69c05817a0e18f7b0ebbeed420f9ab8d1e81b439f439b42917fbe772dfb
  • 5d7116f04e10e968de64c4201fc7374fa84b364e90f8e4eba0fbc41afeaf468c
  • 60504228b3fc524287bf2a260db933a408639b2f1a29af7538c61b00c4a44c86
  • 909495884627e2e74d07d729b5e046f3ae01cabd9f0a5a99c74d46046a677f7c
  • 968b324be2b89f1a8ee4743d946723c1ffdca16ccfbbbbb68e5b9f60e0bff4c9
  • 9a432ea16e74b36c55ec5faa790937fe752ff2561cef83e44856fd1e72398309
  • ab698a35dc5263f0ca460f09dcbc9f8a4aeb7643365a1e7fa122581ef72c34b6
  • b31f7152a547fa41c31f9c96177b2cd7131a93f7c328bf6da360dc1586ba18dc
  • c957d007824ee8173c67122a1843c979c818614eeed7db03dea3ba7fede43eba
  • d388c309a540d4619169a07a4b64707f4c44953511875b57ad7cfa3e097115af
  • de6c061aafc5d86e692bec45f69b2ea18639abd540b59c2c281717a054a48dd5

CVE Vulnerabilities

Status

CVE-2019-18935

Last edited: 29 June 2021 12:01 pm