Splunk spots malware targeting Windows Server on AWS to mine Monero • The Register

Data analysis firm Splunk says it’s found a resurgence of the Crypto botnet – malware that attacks virtual servers running Windows Server inside Amazon Web Services.

Splunk’s Threat Research Team (STRT) posted its analysis of the attack on Monday, suggesting it starts with a probe for Windows Server instances running on AWS, and seeks out those with remote desktop protocol (RDP) enabled.

Once target VMs are identified, the attackers wheel out an old favourite: brute forcing passwords. If…