PowerGhost Cryptomining Malware Targets Corporate Networks

Cybercriminals using malware to steal the compute power of victims' systems to mine cryptocurrencies are increasingly targeting corporate networks to increase the number of systems they leverage.

The latest example of this is PowerGhost, a cryptomining malware detected by researchers at Kaspersky Lab that not only takes aim at large corporate networks but also uses fileless techniques to make it more difficult to detect. The malware leverages a combination of PowerShell and EternalBlue exploits to spread from a single system on the network to other systems, such as servers and workstations.

The math behind PowerGhost is pretty simple: the longer the malware can stay on the network and the more systems it can infect, the more illicit profits the bad actors can reap. The malware uses the compute power in the infected machines to mine for cryptocurrency, which is transferred to the attackers' wallets.

How PowerGhost has traveled throughout the world.
\r\n(Source: Kaspersky Labs)\r\n

"The task of crypto-miners' owners is to attract as many computing resources as possible," Anatoly Kazantsev, malware analyst at Kaspersky, told Security Now in an email. "A large number of computing resources can increase the income of cybercriminals. Therefore, for cybercriminals, the infrastructure of corporate networks is a tidbit in terms of number of users. Updates are often installed with delay on corporate networks, allowing cybercriminals to use public hacking tools, saving money on buying [zero]-day exploits."

Kazantsev and Kaspersky analyst Vladav Bulavas in a blog on Kaspersky's SecureList site described PowerGhost as an "obfuscated PowerShell script that contains the core code and the following add-on modules: the actual miner, mimikatz, the libraries msvcp120.dll and msvcr120.dll required for the miner's operation, a module for reflective PE injection and a shellcode for the EternalBlue exploit."

The code doesn't need to use files and isn't stored directly on the system's hard drive, making it more difficult to antivirus solutions to detect it, according to the researchers. Instead, the victim's machine is infected remotely by using either exploits or remote administration tools like Windows Management Instrumentation. Once that happens, the PowerShell script is run and downloads the miner, while the virus makes a copy of itself and moves on to infect other systems in the network using the EternalBlue exploit, which was leveraged to great success by the WannaCry and NotPetya ransomware attacks last year. (See WannaCry: How the Notorious Worm Changed Ransomware.)

"The choice of fileless techniques by the cybercriminals is not accidental," Kazantsev told Security Now. "With this approach, malware leaves virtually no traces in the system, which increases the chances of a successful launch and allows to stay unnoticed longer in the system. That is why it is so important to choose security solutions that use a comprehensive approach in the fight against malware."

Malware evolution
Another characteristic of PowerGhost is its ability to run other attacks that don't involve cryptomining. According to the researchers, in one version of PowerGhost, they found a tool for running distributed denial-of-service (DDoS) attacks. The DDoS function is the only one in PowerGhost that copies files to the hard drive, making researchers believe that it probably is a test tool that will be replaced by a fileless implementation later.

"In general, the evolution of crypto miners, like with most other malware, is moving towards reducing visibility [fileless technology], long-term gaining in the systems and obtaining additional income," Kazentsev said, noting the "DDoS-module in the sample."

Such evolution in targets and capabilities has been seen other malware.

The Hide 'N Seek (HNS) botnet is an example. The botnet, which was discovered earlier this year, initially targeted Internet of Things (IoT) devices, including home routers and DVRs. Researchers at Qihoo 360's Netlab earlier this month reported that the latest versions of the HNS botnet now are taking aim at other systems, including NoSQL database servers, and include a program for mining cryptocurrencies, though the researchers don't believe the program is functional yet. (See HNS IoT Botnet Evolves, Goes Cross-Platform.)

Kazentsev added that he expects malware to continue to evolve and add more targets, saying that "the infrastructure of corporate networks is an excellent prey for owners of crypto-mining botnets, so it is likely that in the future cybercriminals will develop their own techniques and tools designed for corporate networks."

PowerGhost has a global reach to it, with instances of infection being found in North and South America, Russia and other parts of Asia, Europe and Africa. Users in India, Brazil, Colombia and Turkey, according to Kaspersky analysts.

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.