The Pro-Ocean cryptojacking malware now comes with the ability to spread like a worm. Researchers have identified an updated malware variant used by the cybercrime gang Rocke Group that targets cloud infrastructures with crypto-jacking attacks. The malware is made up of four components: A rootkit module that installs a rootkit and other malicious services; a mining module that runs the XMRig miner; and an infection module that contains worm capabilities. Researchers say they believe that the group will continue to actively target the cloud as the cloud grows for attackers.
Source: https://threatpost.com/rocke-groups-malware-now-has-worm-capabilities/163463/