From gbhackers.com
A new InfoStealer malware has been identified which targets the windows servers, stealing its sensitive data that includes the login credentials, OS version, IP addresses and also uploads the victim’s data to the FTP attacker’s server.
Security researchers form Checkpoint observed a huge malware campaign that runs malicious contents specifically to steal sensitive data from windows server using Mimikatz tool and the campaign specifically targets countries in Asia.
The infection starts with the executable file, downloaded from 66[.]117.6.174/ups.rar and then it gets executed on the victim’s machine, and continues to check if the compromised machine is a windows server or not.