MyKings Botnet Description
The MyKings Botnet is a network of Trojans that hijacks vulnerable Windows servers and uses them for mining cryptocurrency. Infections usually will include additional threats, such as the backdoor Trojan Forshare. Site administrators should strengthen their security practices for proactive protection and use anti-malware services for removing the MyKings Botnet's bots.
A Royal Sovereign over Monero Coins
The MyKings Botnet is a long-running, decentralized network of Trojans. While the eventual aim of a MyKings Botnet infection is little more than making Monero, the botnet is impressive for the depth of redundancy in its features. It also is an accurate showing of how many botnets 'earn' their place on the Internet, today: by grabbing the lowest hanging fruit.
The MyKings Botnet spreads through targeting weakly-secured servers on Windows machines. It searches for outdated software, accessible RDP, brute-forcible credentials, etc., and even is compatible with dedicated CCTV hardware. Although malware experts have long since rated the MyKings Botnet's activities as being global, Asian nations are at high risk statistically. Countries with the highest infection rates include China, Russia and Taiwan.
The MyKings Botnet drops a variant of the backdoor Trojan, Forshare, which runs the cryptocurrency-mining module. This activity lets 'zombie' servers in the botnet generate coins for the threat actors, potentially burning out hardware or causing performance issues as they do so. The MyKings Botnet also joins the numbers of many threats that close and remove both competing Trojans and some AV solutions through a series of 'taskkill' commands and scheduled tasks.
Toppling the Throne of Illicitly-Gained Wealth
The MyKings Botnet is an open-source threat, but not due to any incompetence on its authors' parts. Modifications over time display significant competence and willingness for experimenting with different evasion methods, such as picture-abusing steganography (a la Titanium, Okrum, and others). It also is capable of automatic reinstallation, assuming that core components like the 'c3' batch file are intact.
Server administrators should maintain all appropriate practices for limiting the spread of the Trojan network, such as:
- Deactivating Remote Desktop features and securing the with strong passwords
- Using credentials that aren't weak to brute-force attacks (such as 'admin123')
- Installing security patches for server software as soon as possible
- Operating under the philosophy of 'principle of least privilege' for user accounts
- Conducting regular server audits
- Storing backups in secure locations
Most Windows anti-malware tools should detect and delete the MyKings Botnet's bot, the Forshare Trojan, and the associated Monero miner automatically. However, updating threat databases can be integral to accurate identifications for regularly-updated and maintained threats like this one.
The MyKings Botnet makes its money – millions of dollars worth of it – off of the backs of those who forget their server's safety. Since inviting a Trojan inside is much easier than getting it out again, one always should stop and reconsider when avoiding an inconvenient update or a new choice of password.
Use SpyHunter to Detect and Remove PC Threats
If you are concerned that malware or PC threats similar to MyKings Botnet may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.
Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.