Beapy

New Lemon Duck variants exploiting Microsoft Exchange Server | SOPHOS

LemonDuck has been documented as a cross-platform malware operation that moved beyond Monero mining into credential theft, lateral movement, email propagation, security-tool tampering, and delivery of follow-on payloads on both Windows and Linux systems. Researchers said the malware spreads through phishing, USB and network shares, brute-force attacks against services including RDP, SSH, SMB, MSSQL, and Redis, and exploitation of known flaws such as CVE-2017-0144 and Microsoft Exchange ProxyLogon. The campaign also used fileless PowerShell execution, scheduled tasks, and WMI event subscriptions for persistence, while deploying components such as XMRig, password-dumping tools, and in some cases Mimikatz and Ramnit.

New Lemon Duck variants exploiting Microsoft Exchange Server | SOPHOS

Lemon-Duck Cryptominer Technical Analysis

LemonDuck botnet evolves to allow hands-on-keyboard intrusions | The Record from Recorded Future News

When coin miners evolve, Part 2: Hunting down LemonDuck and LemonCat attacks | Microsoft Security Blog

When coin miners evolve, Part 1: Exposing LemonDuck and LemonCat, modern mining malware infrastructure | Microsoft Security Blog

Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

IoCs/Trojan-LDMiner.csv at master · sophoslabs/IoCs · GitHub