LemonDuck and LemonCat have evolved beyond just being coin miners

The malware that started as cryptocurrency miners are now more dangerous than ever

What started out as annoying cryptocurrency coin miners have now evolved into something far more dangerous. LemonDuck and LemonCat have moved beyond their mining botnet origins into something far more sinister.

Today, LemonDuck is an actively updated malware that mines coins but also steals your credentials. It can remove security protocols and weakens your pc, making it ripe for potential threat actors to take control off.

"It uses a wide range of spreading mechanisms—phishing emails, exploits, USB devices, brute force, among others—and it has shown that it can quickly take advantage of news, events, or the release of new exploits to run effective campaigns," says Microsoft's 365 Defender Threat Intelligence Team.

"For example, in 2020, it was observed using COVID-19-themed lures in email attacks. In 2021, it exploited newly patched Exchange Server vulnerabilities to gain access to outdated systems," the team added.

What makes LemonDuck more dangerous is that it has spread worldwide. According to Microsoft's report, United States, Russia, China, Germany, UK, India, Korea, Canada, France and Vietnam have known reported cases of LemonDuck infestation.

The threat is also cross-platform and is constantly evolving thanks to active updates. Microsoft says that primary spread of LemonDuck and LemonCat are through phishing mails with subjects such as, "The Truth of COVID-19, COID-19 nCov Special info WHO, HALTH ADVISORY: CORONA VIRUS, WTF, What the fcuk, good bye, farewell letter, broken file, this is your order."

These mails usually have an attachment and contain email body content that is designed to make you download the file, a few examples that Microsoft gave are, "Virus actually comes from United States of America, what's wrong with you? are you out of your mind!!! and file is brokened, i can't open it."

If you ever see one of these mails in your inbox, don't open them and delete them.