Cryptocurrency web mining: In union there is profit

guest · Aug 30, 2018

New Threat Actor ‘Rocke’: A Rising Monero Cryptomining Menace
August 30, 2018
https://threatpost.com/new-threat-actor-rocke-a-rising-monero-cryptomining-menace/137090/

Researchers are warning of a Chinese-language threat actor leveraging a wide array of Git repositories to infect vulnerable systems with Monero-based cryptomining malware.

“Rocke will continue to leverage Git repositories to download and execute illicit mining onto victim machines,” the research team said in a post Thursday. “It is interesting to note that they are expanding their toolset to include browser-based miners, difficult-to-detect trojans, and the Cobalt Strike malware.”

Cisco Talos said it first spotted the threat actor in April 2018 when its malware was found in both Western and Chinese honeypots attempting to exploit the an Apache Struts vulnerability.

“After months of research, we believe that Rocke is an actor that must be followed, as they continue to add new features to their malware and are actively exploring new attack vectors,” wrote David Liebenberg, senior threat analyst, who authored the Cisco Talos report.
Click to expand...

guest · Sep 6, 2018

Apache Struts 2 Vulnerability (CVE-2018-11776) Exploited in CroniX Crypto-Mining Campaign
September 4, 2018
https://www.f5.com/labs/articles/th...nerability--cve-2018-11776--exploited-in-cron

As with many other Apache Struts 2 vulnerabilities, CVE-2018-11776 allows attackers to inject Object-Graph Navigation Language (OGNL) expressions, which might contain malicious Java code that is evaluated under several circumstances. This time, the injection point is within the URL.
[...]
For some miners, the attacker decides to take a more careful approach and check each process name and process CPU usage and then kill only those processes that utilize 60 percent or more of the CPU resources.

The attacker sends a single HTTP request while injecting an OGNL expression that, once evaluated, executes shell commands to download and execute a malicious file.
The Mining Operation
The attacker communicates with a Monero (XMR) pool at “eu.minerpool.pw”
[...] Enterprises must be as vigilant as ever about patching affected systems immediately.
Click to expand...

guest · Sep 13, 2018

Sly malware author hides cryptomining botnet behind ever-shifting proxy service
September 13, 2018
https://www.zdnet.com/article/sly-m...ng-botnet-behind-ever-shifting-proxy-service/

Although most botnets are a carbon copy of one another, once in a while researchers spot one that stands out above the crowd. This week, the cryptomining botnet that took the crown in terms of creativity was one discovered by the Netlab team at Qihoo 360.

And according to the Netlab team, the thing that stood out about this botnet was that instead of letting infected bots connect to a remote server via a direct connection, its authors were using the ngrok.com service instead.

[...] have indirectly gained a resilience against any attempted takedowns of his C&C server.
As Hui explains, this happens because ngrok.io URLs stay online for only around 12 hours, and by the time security researchers identify a new C&C URL, the ngrok.io link changes to a new one, hiding the botnet from researchers once more.

There's also a module to scan for local Ethereum wallets, but this is not active. On the other hand, a module that injects the Coinhive JavaScript library in all of the server's JS files is active, meaning the botnet will also mine Monero inside the browsers of users visiting a site hosted on the infected servers.
Click to expand...

A technical analysis and some indicators of compromise (IOCs) are available in Netlab's report, here.
Click to expand...

guest · Sep 17, 2018

Hackers secretly ran cryptocurrency mining malware on Indian government sites
It's a hive of activity
September 17, 2018
https://thenextweb.com/hardfork/2018/09/17/indian-government-cryptocurrency-coinhive/

The crypto-jacking epidemic has spread to India. It has come to light that tons of Indian government sites have been infected with cryptocurrency mining malware, designed to steal visitors’ computing power to earn coins.

Among others, the attackers targeted the websites of the Andhra Pradesh municipality, the Tirupati Municipal Corporation, and the Macherla municipality, the India Times reports.

The government has since confirmed the attack is indeed authentic. As of yesterday, the websites were still actively mining cryptocurrency.
According to the report, the affected pages were running the popular CoinHive script, built for mining anonymous currency Monero.
Click to expand...

guest · Sep 17, 2018

One in three UK orgs hit by cryptojacking in previous month, survey finds
September 17, 2018
https://www.welivesecurity.com/2018/09/17/uk-orgs-hit-cryptojacking-survey/

The study, commissioned by Citrix and carried out by OnePoll in May 2018, also reveals that 59% of IT decision-makers have been alerted to covert cryptocurrency mining on their systems at some point in the past, rather than in the last month alone, Internet of Business reports. Of those, 80% were affected in the last six months, which roughly coincides with a surge in popularity of cryptojacking.

Meanwhile, 38% of the respondents said that they have never experienced such an attack.

The study also found that, in most cases (60% ), up to 50 devices were hit by cryptojacking. A total of 11% percent of the respondents said that over 100 machines were affected in the most recent attack. All respondents work in organizations of at least 250 employees each.
Click to expand...

guest · Sep 22, 2018

Ngrok Mining Botnet
September 20, 2018
https://oncyberblog.wordpress.com/2018/09/20/ngrok-mining-botnet/

The Ngrok campaign is unique in terms of its overall sophistication for a Docker based attack vector. Specifically, it demonstrates a novel, dynamic and robust operational security model and ability to detect and attack newly deployed and mis-configured infrastructure.

The campaign has gone largely un-noticed until a recent blog published by 360totalsecurity which prompted me to finally write-up the analysis. As of today (20 Sept) the campaign is still active.
[...]
The campaign has produced a steady, but relatively low, stream of income. It is possible that other accounts are used – in fact we also have the Coinhive account, which we are unable to determine the hashing rate or any payment details.

Between April and late August the attackers had made approx £5000 GBP.
Click to expand...

Minimalist · Sep 24, 2018

459% Activity Increase for Cryptocurrency Mining Malware since 2017

Illegal cryptocurrency mining (aka cryptojacking) security incidents have seen a 459% increase since 2017 according to an analysis by the Cyber Threat Alliance (CTA).

As discovered by CTA, the number of instances where unauthorized cryptocurrency mining was behind a detected security attack has seen a prodigious rise for both enterprise and home users.
Click to expand...

https://news.softpedia.com/news/459...rrency-mining-malware-since-2017-522864.shtml

guest · Oct 11, 2018

Fake Flash Updaters Push Cryptocurrency Miners
October 11, 2018
https://researchcenter.paloaltonetw...ke-flash-updaters-push-cryptocurrency-miners/

As early as August 2018, some samples impersonating Flash updates have borrowed pop-up notifications from the official Adobe installer. These fake Flash updates install unwanted programs like an XMRig cryptocurrency miner, but this malware can also update a victim’s Flash Player to the latest version.

Because of the legitimate Flash update, a potential victim may not notice anything out of the ordinary. Meanwhile, an XMRig cryptocurrency miner or other unwanted program is quietly running in the background of the victim’s Windows computer.

[...] Windows provided a typical warning about an unknown publisher that victims can easily click through on vulnerable Windows hosts.
Conclusion
This campaign uses legitimate activity to hide distribution of cryptocurrency miners and other unwanted programs. Organizations with decent web filtering and educated users have a much lower risk of infection by these fake updates.
Click to expand...

guest · Oct 15, 2018

iPhone a Growing Target of Crypto-Mining Attacks
October 15, 2018
https://www.infosecurity-magazine.com/news/iphone-a-growing-target-of/

Apple has increasingly been the target of crypto-mining attacks, and according to Check Point, iPhone attacks increased by nearly 400% over the last two weeks in September.

In its most recently published Global Threat Index, Check Point researchers said they are continuing to investigate the reasons behind this sharp increase but reported that crypto-miners continued to be the most common malware in September 2018.

While Coinhive currently impacts 19% of global organizations, researchers also reported that the information-stealing Trojan Dorkbot held onto second place with a 7% global impact. [...]
The mining malware that rivals Coinhive, known as Cryptoloot, ranked third place overall on the Threat Index, making it the second-most prevalent crypto-miner in the index.

“Crypto-mining continues to be the dominant threat facing organizations globally,” [...] "What is most interesting is the fourfold increase in attacks against iPhones and against devices using the Safari browser during the last two weeks of September. [...]"
Click to expand...

cruelsister · Oct 15, 2018

The glory days of mining may be over:

https://www.marketwatch.com/story/i...ing-money-2018-10-12?siteid=yhoof2&yptr=yahoo

itman · Oct 15, 2018

cruelsister said: ↑

The glory days of mining may be over:

https://www.marketwatch.com/story/i...ing-money-2018-10-12?siteid=yhoof2&yptr=yahoo
Click to expand...

Time to start hanging around the colleges for "recuiting" purposes:

So for retail investors, unless you’re a student pilfering electricity from your dorm room, rewards from mining are dwindling away.
Click to expand...

Minimalist · Oct 20, 2018

Threat Actors Obfuscate JavaScript to Hide Crypto-Mining Malware

Victims who visited a site infected with the malicious JavaScript code unwittingly unleashed a payload that was hidden within a header file of a WordPress theme, according to researchers from Sucuri.
Click to expand...

https://securityintelligence.com/ne...ate-javascript-to-hide-crypto-mining-malware/

guest · Oct 26, 2018

Cybercriminals exploit misconfigured container to deliver cryptominer
October 26, 2018
https://www.scmagazine.com/home/sec...sconfigured-container-to-deliver-cryptominer/

Threat actors have exploited misconfigured Docker containers to deliver cryptomining malware.

“Docker implements virtualization on the operating-system (OS) level — also known as containerization,” researchers said in an Oct. 25 blog post. “The Docker APIs, in particular, allow remote users to control Docker images like a local Docker client does. Opening the API port for external access is not recommended, as it can allow hackers to abuse this misconfiguration for malicious activities.”

The attacks weren’t the result of the Docker engine being compromised or problems within Docker’s enterprise platform but instead were the result of misconfiguration set up at the administrator level.

The attackers often exploited the misconfigurations to create Docker containers through exposed API ports [...]
Click to expand...

Minimalist · Nov 7, 2018

Bitcoin Cryptojacking Attack Forces University to Disable Entire Network

Canadian St. Francis Xavier University shut down the entire network following a cryptojacking attack which attempted to use its systems' computing power to mine for Bitcoin.
Click to expand...

https://news.softpedia.com/news/bit...ersity-to-disable-entire-network-523646.shtml

itman · Nov 10, 2018

Cryptocurrency Mining Malware uses Various Evasion Techniques, Including Windows Installer, as Part of its Routine

Here's one that only Trend Micro is detecting so far: https://blog.trendmicro.com/trendla...ing-windows-installer-as-part-of-its-routine/

guest · Nov 15, 2018

Misconfigured Docker Services Actively Exploited in Cryptojacking Operation
November 15, 2018
https://www.bleepingcomputer.com/ne...ctively-exploited-in-cryptojacking-operation/

Adversaries looking for an easy way to mine for cryptocurrency are actively targeting publicly exposed Docker services. They use a malicious script capable to scan the network in search of vulnerable hosts and compromise them.

Docker containers are highly popular because they allow virtualization at the operating system level. This enables running applications in a lighter virtual environment, complete with all the dependencies they need.
Living off the land
Researchers at Juniper Networks discovered that cybercriminals are currently taking advantage of misconfigured Docker services to add their own containers that run a Monero mining script.

According to a report Juniper Networks shared with BleepingComputer, once the attacker reaches a vulnerable Docker host they start a container and run commands to download and launch 'auto.sh,' a script that helps extend the operation. It also checks the system for specific packages and downloads any that are missing, in order to continue proliferation to other hosts.
Click to expand...

guest · Nov 19, 2018

Make-A-Wish Website Compromised for Cryptojacking Operation
November 19, 2018
https://www.bleepingcomputer.com/ne...site-compromised-for-cryptojacking-operation/

Operators of a known campaign that compromises websites still vulnerable to the Drupalgeddon 2 security bug targeted ‘worldwish.org’ and planted a script that uses the computing resources of the visitor’s systems to mine for cryptocurrency.
The risk of an outdated CMS
The mining script was hosted at ‘drupalupdates[.]tk,’ a location tied with cybercriminal activities leveraging the vulnerability affecting outdated installations of the Drupal content management system.

According to research from Trustwave SpiderLabs, the attackers injected the Make-A-Wish website with CoinIMP, a free JavaScript Web Miner created as an alternative method to generate profit from websites than displaying advertisements.

The investigation revealed that the attackers relied on multiple techniques to avoid static detections; one of them was to change the domain name hosting the JavaScript miner.
Blacklisting identification solutions would also fail because of the WebSocket use of various domains and IP addresses.
Click to expand...

SpiderLabs Blog:
Hacker's Wish Come True After Infecting Visitors of Make-A-Wish Website With Cryptojacking
https://www.trustwave.com/Resources...rs-of-Make-A-Wish-Website-With-Cryptojacking/

guest · Dec 10, 2018

Pulling Linux Rabbit/Rabbot Malware Out of a Hat
December 6, 2018
https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat

Cyber threat researchers from Anomali Labs have discovered a new malware, called “Linux Rabbit,” that targeted Linux servers and Internet-of-Things (IoT) devices in a campaign that began in August 2018 and continued until October 2018. The campaign utilizes two strains of malware that share the same code base called Linux Rabbit and “Rabbot”.

The goal of this campaign is to install cryptocurrency miners onto the targeted servers and devices. The type of Monero cryptominer installed is dependent upon what the machine’s architecture is.

The malware’s second functionality is to gain persistence on an infected machine. This is completed through “rc.local” files and “.bashrc” files. After obtaining persistence, the next functionality of Linux Rabbit is to brute force SSH passwords which ultimately allows the malware to install the cryptocurrency miner onto the server.
Click to expand...

guest · Dec 12, 2018

Cryptocurrency Miner Spreads via Old Vulnerabilities on Elasticsearch
December 12, 2018
https://blog.trendmicro.com/trendla...ads-via-old-vulnerabilities-on-elasticsearch/

The attack was deployed by taking advantage of known vulnerabilities CVE-2015-1427, [...] and CVE-2014-3120, a vulnerability in the default configuration of Elasticsearch. The vulnerable versions are no longer supported by Elasticsearch

We found a search query with the following command (also described in a blog by ISC) on a server running Elasticsearch [...]
It is important to note that this kind of attack is not new, but it has recently reemerged. For instance, Trend Micro Smart Protection Network feedback in November detected the cryptocurrency miner on endpoints in several countries such as China, Taiwan, and the United States.

This attack is relatively simple, yet can have a significant impact on the victim. Once the attacker gains the ability to run arbitrary commands on the system, he can attempt to escalate the privileges or even pivot to other systems in order to compromise the network further.
Click to expand...

guest · Dec 18, 2018

A Look at 3 Illicit Mining Groups Who Target Enterprise Services
December 18, 2018
https://www.bleepingcomputer.com/ne...mining-groups-who-target-enterprise-services/

New research explores the similarities of three illicit mining cybercrime groups that are known to compromise enterprise services in order to install miners. Combined, these three groups have generated approximately 1,200 Monero coins, which at one point were worth over $400 USD each.

"Through Cisco Talos’ investigation of illicit cryptocurrency mining campaigns in the past year, we began to notice that many of these campaigns shared remarkably similar TTPs, which we at first mistakenly interpreted as being attributed to a single actor," Cisco Talos stated in research shared with BleepingComputer.
Fall of cryptocurrency affecting cryptojacking?
In January 2018 a single Monero coin was worth over $400 USD. Now that same coin is worth only $45.

With these rapid declines in value for cryptocurrency, the question is whether cybercrime groups will continue focusing on cryptojacking as a way to earn revenue?
Click to expand...

guest · Jan 10, 2019

Report: GitHub hosts the most cryptocurrency mining malware of any site
January 10, 2019
https://thenextweb.com/hardfork/2019/01/10/github-cryptocurrency-mining-malware/

What’s noteworthy is that an overwhelming majority of the XMR mined through cryptojacking campaigns has gone directly to one cryptocurrency mining pool: crypto-pool.
GitHub hosts a lot of cryptocurrency mining malware
The researchers found hackers are using legitimate sites like GitHub and Dropbox to facilitate the spread of cryptocurrency mining malware.

Cryptojackers build special malware “droppers,” a variant of Trojan horse computer virus that forces a target to download and install more malware.
Most of the time, these droppers downloaded standard Monero mining tools hosted by GitHub.
Click to expand...

Study: "A First Look at the Crypto-Mining Malware Ecosystem: A Decade of Unrestricted Wealth" (PDF): https://arxiv.org/pdf/1901.00846.pdf

guest · Jan 17, 2019

This cryptocurrency mining malware now disables security software to help remain undetected
Cryptojacking campaign targets Linux servers that haven't had patches for known vulnerabilities applied
January 17, 2019
https://www.zdnet.com/article/this-...-security-software-to-help-remain-undetected/

A form of cryptojacking malware has added the ability to disable cloud security software to help avoid detection and increase its chance of illicitly mining for cryptocurrency without being discovered.
It's the first time this attack technique has ever been seen, said the researchers at security company Palo Alto Networks' research division Unit 42 [...]

As well as running the miner, the malware can also kill any other cryptojacking processes that might already be exploiting the target -- a common tactic [...]
But the trump card for this attack is how it's capable of evading detection from cloud security services by shutting them down. The malware is specially built to not exhibit any malicious behaviours when it first arrives on the system. And it avoids suspicion because it follows procedures detailed on the service provider's websites as to how to uninstall the Cloud Host Security product.

Researchers say the campaign uses the same kind of Linux coin mining malware as as the Rocke cyber crime group -- also known as Iron -- which has been very active in recent years.
Click to expand...

Unit 42 blog entry: Malware Used by “Rocke” Group Evolves to Evade Detection by Cloud Security Products

itman · Feb 27, 2019

Coinhive In-Browser Cryptomining Service Shuts Down on March 8

The Coinhive cryptomining mining service which was designed to offer web developers a JavaScript-based Monero miner announced that it will discontinue its services on March 8, 2019.
Click to expand...

https://www.bleepingcomputer.com/ne...r-cryptomining-service-shuts-down-on-march-8/

Good riddance!

guest · Mar 1, 2019

Linux servers targeted by new Chinese crypto-mining group
Researchers discover new Antd crypto-mining malware targeting Linux systems
March 1, 2019
https://www.zdnet.com/article/linux-servers-targeted-by-new-chinese-crypto-mining-group/

Discovered by security researchers at Intezer, this new group --which they named Pacha Group-- hasn't targeted Linux servers directly, but the apps that run on top.

Experts say Pacha Group hackers use brute-force attacks to compromise services like WordPress or PhpMyAdmin, and once they have an initial foothold, they escalate their access to the underlying server, where they deploy their malware, which Intezer has named Linux.GreedyAntd (hereinafter Antd).

A report by a Chinese security researcher places the first sighting of Antd in mid-September 2018.
According to Intezer's technical deep dive into the malware's inner workings, Antd is a complex piece of code that is designed around a modular structure and designed to work with multiple command and control servers.
[...] adds a Systemd service that mimics the legitimate mandb service. Unless investigators know what they're looking for, it's hard to spot Antd's backdoor, and servers will most likely get reinfected over and over again.
Click to expand...

Intezer says this Antd module is a modified XMRig variant that uses the Stratum mining protocol, but instead of storing local config files, it uses a proxy service to hide its settings and wallet address.
For now, Linux server owners should be aware that this threat is out there.
Click to expand...

guest · Mar 16, 2019

mood said: ↑

New Threat Actor ‘Rocke’: A Rising Monero Cryptomining Menace
August 30, 2018
https://threatpost.com/new-threat-actor-rocke-a-rising-monero-cryptomining-menace/137090/
Click to expand...

Rocke Evolves Its Arsenal With a New Malware Family Written in Golang
March 15, 2019
https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang

Rocke is actively updating and pushing a new dropper using Pastebin for Command and Control (C2).
According to VirusTotal, the threat detection of the new dropper is nearly non-existent.

The group has been observed in previous campaigns to use “ld.so.preload” function to hook libc functions. The hooking is used to hide the dropper and the mining software installed by the malware and prevents it from showing up in the “currently running” process list. This tactic is being utilized by the group in this new campaign. The miner uses a private mining pool hosted on DigitalOcean which is a change in the threat actor’s previous tactics.
Click to expand...

Log in or Sign up

Cryptocurrency web mining: In union there is profit

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

cruelsister Registered Member

itman Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

guest Guest

Log in or Sign up

Cryptocurrency web mining: In union there is profit

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

cruelsister Registered Member

itman Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

guest Guest

Useful Searches