The Lemon Duck cryptocurrency-mining botnet targets victims computer resources to mine the Monero virtual currency. The botnet has been active since at least the end of December 2018, Cisco Talos researchers say. Recent attacks have included a Linux branch and a module allowing further spread by sending emails to victims with COVID-19 lures. Researchers say Lemon Duck is one of the more complex mining botnets, with several interesting tricks up its sleeve. The malware has at least 12 independent infection vectors more than most malware.
Source: https://threatpost.com/lemon-duck-cryptocurrency-botnet/160046/