Nitrokod Crypto Miner Infected systems across 11 countries since 2019

guest · Sep 3, 2022

By Ravie Lakshmanan - August 29, 2022

A Turkish-speaking entity called Nitrokod has been attributed to an active cryptocurrency mining campaign that involves impersonating a desktop application for Google Translate to infect over 111,000 victims in 11 countries since 2019.

"The malicious tools can be used by anyone," Maya Horowitz, vice president of research at Check Point, said in a statement shared with The Hacker News. "They can be found by a simple web search, downloaded from a link, and installation is a simple double-click."
The list of countries with victims includes the U.K., the U.S., Sri Lanka, Greece, Israel, Germany, Turkey, Cyprus, Australia, Mongolia, and Poland.
Click to expand...

The campaign entails serving malware through free software hosted on popular sites such as Softpedia and Uptodown. But in an interesting tactic, the malware puts off its execution for weeks and separates its malicious activity from the downloaded fake software to avoid detection.

A notable aspect of the Nitrokod campaign is that the fake software offered for free are for services that do not have an official desktop version, such as Yandex Translate, Microsoft Translate, YouTube Music, MP3 Download Manager, and Pc Auto Shutdown.
Click to expand...

Furthermore, the malware is dropped almost a month after the initial infection, by when the forensic trail is deleted, making it challenging to break down the attack and trace it back to the installer.

"What's most interesting to me is the fact that the malicious software is so popular, yet went under the radar for so long," Horowitz said. "The attacker can easily choose to alter the final payload of the attack, changing it from a crypto miner to, say, ransomware or banking trojan."
Click to expand...

Check Point Research detects Crypto Miner malware disguised as Google translate desktop and other legitimate applications

Highlights:

Check Point Research (CPR) detected a Turkish based crypto miner malware campaign, dubbed ‘Nitrokod’, which infected machines across 11 countries

The malware is dropped from popular software available on dozens of free software websites

The malware distributers separate malicious activity from the downloaded fake software to avoid detection

Attack was initially found by Check Point XDR, which overcomes the attack’s evasion mechanism

Click to expand...

Log in or Sign up

Nitrokod Crypto Miner Infected systems across 11 countries since 2019

guest Guest

Log in or Sign up

Nitrokod Crypto Miner Infected systems across 11 countries since 2019

guest Guest

Useful Searches