Security company: NSABuffMiner mining trojan occupied campus servers and made illegal profits of 1.15 million yuan

Recently, Tencent Smart Security Yujian Threat Intelligence Center received user feedback that the school's intranet water card management server frequently crashed. After testing, it was found that the school's intranet water card management server was invaded by the rundllhost.exe mining trojan, which is a variant of the NSASrvanyMiner mining trojan, using NSA weapons and tools to attack and spread in the intranet. Because the server has an unpatched ms17-010 vulnerability, it was attacked and used for mining. So far, the NSABuffMiner mining trojan has mined 1,217 Monero coins, with illegal profits of up to 1.15 million yuan.