Sharp Rise in Mining-Related Malware on the Russian-speaking Underground
Verint’s powerful portfolio of interception and monitoring solutions provides full monitoring and operational value. Dedicated systems address separate real-time and retroactive investigation needs, for lawful monitoring, field operations and background research. In the case below, we have used our Cyber and Webint suite to constantly monitor, collect and analyze malware-related items, to gain actionable intelligence and perform the investigation.
We constantly monitor groups, markets and IM channels manually and automatically, in this case, our monitoring has revealed in recent months a sharp rise in mining malware traded on numerous Dark Web forums, where hackers of various underground communities reside. This is hardly surprising, considering the rise in the value of cryptocurrency since late 2017. As a ramification of this trade, in recent months, a sharp rise in mining malware attacks has also been observed.
The rise in the trade in mining malware originates with cybercriminals engaged in attacks against banks and their clients, who are currently opting to focus on attacks designed to bring various kinds of cryptocurrency into their hands. For instance: Verint analysts spotted known sellers of banking malware, starting to offer for sale malware related to crypto-currency mining. Click To Tweet These attacks can be divided into two types:
- Infection with mining malware – we have spotted a rise in the trade of mining malware in hacking communities, as well as an increase in the number of discussions related to these types of attacks. This indicates an elevated interest in this field and a shift by hackers previously engaged in other criminal activities to acquiring knowledge and attack tools in the illegal mining field. These attacks are targeting a wide scope of end users and servers, and are designed to take advantage of their systems’ resources to mine cryptocurrency. Along with the slowdown of the infected system, mining malware can sometimes cause significant damage to the hardware, as in the case of the Loapi Android Trojan that worked a phone so hard its battery overheated and burst open the device’s back cover.
- Attacks against cryptocurrency holders, be they private wallet owners or cryptocurrency exchange platforms. While the former are usually targeted by phishing or Man-in-the-Middle (MitM) attacks designed to steal credentials, the latter is a large-scale attack designed to steal cryptocurrency from the exchange platform. We see a large volume of evidence related to the first type in closed sources, but the second type is usually coordinated outside of hacking forums.
The picture received from our automatic monitoring systems surfaced according to pre-defined queries supports these findings, which were manually identified by our analysts. More than 4,000 mentions of “miner” on password-protected forums were identified in the period between September 1, 2017, and February 24, 2018, compared to just 1,000 for the same period one year earlier. In addition, a sharp rise in the number of discussions can be clearly observed starting from mid-October 2017, following the rise in the price of Bitcoin and other cryptocurrencies. In fact, the number of discussions on hacking-dedicated platforms correlates with the fluctuations in Bitcoin value (with a slight delay of several days).
Figure 1: Above: The number of discussions from password-protected hacking sources in which the word “miner” was mentioned. Source: Verint DarkAlert;
Figure 2: Below: The value of Bitcoin in USD during the same period. Source: CoinDesk
Another example is the trade of a new mining malware dubbed CryptoNight, which started two months ago (February 10, 2018). For US$ 50, the author offers a miner for a variety of cryptocurrencies (those that use the CryptoNight or CryptoNight-lite algorithm), with a relatively low detection rate (according to tests run by other forum members). The malware also possesses clipboard stealer capabilities designed to steal credentials of the most popular cryptocurrency wallets (Bitcoin, Ethereum, Dogecoin and others).
Author: Verint Cyber Threat Intelligence Research Team
Verint’s Cyber Threat Intelligence (CTI) research team (formerly SenseCy) is comprised of handpicked expert analysts, many of whom are ex-military intelligence, with years of experience in cyber threat intelligence and analysis.
Our research team monitors, analyzes and validates threat actors’ malicious activities on platforms such as social networks, mobile applications, Deep Web sites, Dark Web marketplaces, hacker forums, IRC channels, global CVEs and external threat intelligence generated by leading security providers. The Research team regularly produces threat alerts and intelligence reports based on region, industry and organization-specific threats, including in-depth analysis, actionable recommendations, IoCs and more, to proactively identify and mitigate threats before they materialize, to enhance resilience and prevent future attacks