New CondiBot Variant and Monaco Miner Target Network Devices

A new variant of CondiBot and the Monaco cryptominer are actively targeting network devices, including routers and firewalls, as attackers shift their focus to enterprise infrastructure. This trend has been noted in research showing an eight-fold increase in the exploitation of such devices over recent years. The attacks are attributed to a range of actors, from nation-state groups to financially motivated criminals. The CondiBot variant exploits vulnerabilities in network devices, allowing for initial access and long-term persistence within enterprise environments. The Monaco miner is also being deployed to leverage compromised devices for cryptomining activities. Organizations relying on network infrastructure are particularly vulnerable, as these devices are integral to their operations. Current mitigation strategies are not specified, indicating a pressing need for heightened security measures.

Key Points: • CondiBot and Monaco miner are targeting network devices like routers and firewalls. • Exploitation of network infrastructure has increased eight-fold in recent years. • Attackers include both nation-state actors and financially motivated criminals.