Massive Coinhive Cryptojacking Campaign Infects 170,000 MikroTik Routers

guest · Aug 2, 2018

Massive Coinhive Cryptojacking Campaign Infects 170,000 MikroTik Routers
August 02, 2018
https://www.bleepingcomputer.com/ne...ng-campaign-infects-170-000-mikrotik-routers/

Security researchers have unearthed a massive cryptojacking campaign that targets and infects MikroTik routers with a copy of the Coinhive in-browser cryptocurrency mining script.

The campaign appears to have gotten off the ground this week and was, in its first stages, mainly active in Brazil, but later started targeting MikroTik routers all over the world.

In a report Trustwave shared with Bleeping Computer, Kenin says that the hacker (or hackers) behind this campaign appear to have compromised around 72,000 MikroTik routers in Brazil during the first stages of their attack.
Hacker using April 2018 MikroTik zero-day
According to Kenin, the attacker used one of those PoCs to alter traffic passing through the MikroTik router and inject a copy of the Coinhive library inside all the pages served through the router.
Click to expand...

guest · Sep 4, 2018

Thousands of Compromised MikroTik Routers Send Traffic to Attackers
September 4, 2018
https://www.bleepingcomputer.com/ne...d-mikrotik-routers-send-traffic-to-attackers/

Attackers compromising MikroTik routers have configured the devices to forward network traffic to a handful of IP addresses under their control.
Attackers vacuum the traffic
360Netlab announced in a blog post today that more than 7,500 MikroTik routers across the world are currently delivering their TZSP (TaZmen Sniffer Protocol) traffic to nine external IP addresses.

According to the researchers, the attacker modified the device's packet sniffing settings to forward the data to their locations.
Failed mining operation
Current attacks seek to infect them with the browser-based Coinhive cryptomining script. Cybercriminals achieve this by redirecting HTTP proxy settings to an error page they created, where they placed the mining script. [...] However, the attackers made a mistake
Click to expand...

guest · Sep 11, 2018

Other 3,700 MikroTik Routers compromised in cryptoJacking campaigns
September 11, 2018
https://securityaffairs.co/wordpress/76084/hacking/mikrotik-routers-cryptomining.html

The exploit code for the CVE-2018-14847 vulnerabilities is becoming a commodity in the hacking underground, just after its disclosure crooks started using it to compromise MikroTik routers. Thousands of unpatched devices are mining for cryptocurrency at the moment.

Now the researcher Troy Mursch noticed that the infected MikroTik routers from the latest campaign open a websockets tunnel to a web browser mining script.

“According to the researcher, the malware increases the CPU activity of an infected MikroTik router to about 80% and maintain it at this level.” reads a blog post published by BleepingComputer.
“This gives room for other tasks to run and mine for cryptocurrency at the same time, in the hope of keeping the activity hidden from the user.”
Click to expand...

guest · Oct 6, 2018

Crypto-jacking epidemic spreads to 30K routers across India
Cryptocurrency is mined on every page visited when using infected routers
October 5, 2018
https://thenextweb.com/hardfork/2018/10/05/crypto-jacking-malware-coinhive/

After infesting hundreds of thousands of routers in Brasil with cryptocurrency mining malware, reports indicate hackers have compromized a further 30,000 routers across India.

“The number of compromised routers [in India] has doubled in the past month,” wrote internet security unit Banbreach. “For the top three cities with the most infected routers, the growth has been [500 percent].”

“I found [CoinHive] in the router provided by my ISP a couple of days ago,” tweeted a security enthusiast from Mumbai. “Probably all the routers used by them are infected and outdated.”
Crypto-jackers favorite tool is CoinHive
CoinHive is a supposedly neutral piece of code enabling browsers to mine cryptocurrency, particularly the anonymity-focused altcoin Monero.
Click to expand...

Minimalist · Oct 8, 2018

PoC Attack Escalates MikroTik Router Bug to ‘As Bad As It Gets’

A new hacking technique used against vulnerable MikroTik routers gives attackers the ability to execute remote code on affected devices. The technique is yet another security blow against the MikroTik router family. Previous hacks have left the routers open to device failures, cyptojacking and network eavesdropping.
Click to expand...

https://threatpost.com/poc-attack-escalates-mikrotik-router-bug-to-as-bad-as-it-gets/

guest · Oct 12, 2018

A mysterious grey-hat is patching people's outdated MikroTik routers
Internet vigilante claims he patched over 100,000 MikroTik routers already
October 12, 2018
https://www.zdnet.com/article/a-mysterious-grey-hat-is-patching-peoples-outdated-mikrotik-routers/

A Russian-speaking grey-hat hacker is breaking into people's MikroTik routers and patching devices so they can't be abused by cryptojackers, botnet herders, or other cyber-criminals, ZDNet has learned.

"I added firewall rules that blocked access to the router from outside the local network," Alexey said. "In the comments, I wrote information about the vulnerability and left the address of the @router_os Telegram channel, where it was possible for them to ask questions."

"The attackers are not closing [device ports] or patching the devices, so anyone who wants to further mess with these routers, can," Anubhav told ZDNet.
Click to expand...

itman · Oct 12, 2018

mood said: ↑

A mysterious grey-hat is patching people's outdated MikroTik routers
Click to expand...

Sorry, just don't by this. If the actor is patching router firmware, he by overwhelming odds intends to use those devices later for assumed non-legit activities. He might also be performing a "smoke screen" in that hack code is only placed on select devices.

guest · Oct 20, 2018

MikroTik mayhem: Cryptomining campaign abusing routers
October 18, 2018
https://blog.avast.com/mikrotik-routers-targeted-by-cryptomining-campaign-avast

From September 19th to October 15th, Avast blocked malicious cryptomining URLs related to infected networks with MikroTik gateways, also known as the WinBox vulnerability, over 22.4M times – blocking it for more than 362,616 users on 292,456 networks in the Avast network alone.

Observed, but not previously understood, this malware uses several clever techniques to both take control of the computing power of hundreds of thousands of networks and ensure its persistence in the affected routers.
What’s the harm?
It might seem that the harm of this cryptomining campaign is that it is using your router’s computation power for mining cryptocurrency, but this is not the case.

In fact, all the computers behind the infected router do the job for the attacker, not the router. This is accomplished when the router serves you the malicious cryptominer whenever a user attempts to go to any unsecured web address. The bigger issue, however, is that once the router is compromised, you are not really sure how else it might be abused. It could be used for sniffing the traffic, serving you malicious pages etc.
Click to expand...

guest · Dec 5, 2018

Researchers have discovered over 415,000 routers across the globe have been infected with malware designed to steal their computing power and secretly mine cryptocurrency.
December 4, 2018
https://thenextweb.com/hardfork/2018/12/04/routers-cryptocurrency-miner-malware-monero/

The attack, which is still ongoing, affects MikroTik routers in particular. For the record, the string of crypto-jacking attacks on the brand first began in August [...] The number has more than doubled since then.

While the majority of affected devices was initially concentrated in Brazil, data suggests there are tons of affected devices worldwide.
“It wouldn’t surprise me if the actual number of actual infected routers in total would be somewhere around 350,000 to 400,000,” security researcher VriesHD told Hard Fork.

“CoinHive, Omine, and CoinImp are the biggest services used,” VriesHD told Hard Fork. “It used to be like 80-90 percent CoinHive, but a big actor has shifted to using Omine in recent months.”
Click to expand...

itman · Dec 5, 2018

“The patch for this specific problem has been out for months and I’ve seen ISPs with thousands of infections disappear from the list,” he added. Unfortunately, it appears tons of ISPs simply won’t take action to mitigate the attacks.
Click to expand...

FanJ · Jan 8, 2020

Interpol - 8 Jan 2020
INTERPOL-led action takes aim at cryptojacking in Southeast Asia
https://www.interpol.int/News-and-E...-takes-aim-at-cryptojacking-in-Southeast-Asia

Police, CERTs and private sector come together to mitigate this emerging cybercrime
SINGAPORE – An INTERPOL-coordinated operation in Southeast Asia against an emerging form of cybercrime known as cryptojacking has led to a massive reduction in the number of infected devices across the region.
Click to expand...

Based on data from police and partners in the cybersecurity industry, INTERPOL identified a global cryptojacking campaign facilitated by the exploitation of a vulnerability in MikroTik routers. Intelligence was developed and disseminated via Cyber Activity Reports to the affected member countries.
Click to expand...

During the five months of the operation, cybercrime investigators and experts from police and national Computer Emergency Response Teams (CERTs) across the 10 ASEAN countries (Brunei, Cambodia, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand and Vietnam) worked together to locate the infected routers, alert the victims and patch the devices so they were no longer under the control of the cybercriminals. INTERPOL’s ASEAN Desk facilitated the exchange of information and follow-up actions amongst the countries involved.
Click to expand...

Private sector partners including Cyber Defense Institute and Trend Micro supported the operation through information sharing and analysis of cryptojacking cases, and providing the participating countries with guidelines for patching infected routers and advice on preventing future infections.
Click to expand...

Log in or Sign up

Massive Coinhive Cryptojacking Campaign Infects 170,000 MikroTik Routers

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

itman Registered Member

guest Guest

guest Guest

itman Registered Member

FanJ Updates Team

Log in or Sign up

Massive Coinhive Cryptojacking Campaign Infects 170,000 MikroTik Routers

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

itman Registered Member

guest Guest

guest Guest

itman Registered Member

FanJ Updates Team

Useful Searches