Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Network Security

7/31/2018
08:05 AM
Jeffrey Burt
Jeffrey Burt
Jeffrey Burt
50%
50%

PowerGhost Cryptomining Malware Targets Corporate Networks

Kaspersky Lab researchers said the malware uses fileless techniques to make it harder to detect and the Eternal Blue exploit to spread to systems across the networks.

Cybercriminals using malware to steal the compute power of victims' systems to mine cryptocurrencies are increasingly targeting corporate networks to increase the number of systems they leverage.

The latest example of this is PowerGhost, a cryptomining malware detected by researchers at Kaspersky Lab that not only takes aim at large corporate networks but also uses fileless techniques to make it more difficult to detect. The malware leverages a combination of PowerShell and EternalBlue exploits to spread from a single system on the network to other systems, such as servers and workstations.

The math behind PowerGhost is pretty simple: the longer the malware can stay on the network and the more systems it can infect, the more illicit profits the bad actors can reap. The malware uses the compute power in the infected machines to mine for cryptocurrency, which is transferred to the attackers' wallets.

"The task of crypto-miners' owners is to attract as many computing resources as possible," Anatoly Kazantsev, malware analyst at Kaspersky, told Security Now in an email. "A large number of computing resources can increase the income of cybercriminals. Therefore, for cybercriminals, the infrastructure of corporate networks is a tidbit in terms of number of users. Updates are often installed with delay on corporate networks, allowing cybercriminals to use public hacking tools, saving money on buying [zero]-day exploits."

Kazantsev and Kaspersky analyst Vladav Bulavas in a blog on Kaspersky's SecureList site described PowerGhost as an "obfuscated PowerShell script that contains the core code and the following add-on modules: the actual miner, mimikatz, the libraries msvcp120.dll and msvcr120.dll required for the miner's operation, a module for reflective PE injection and a shellcode for the EternalBlue exploit."

The code doesn't need to use files and isn't stored directly on the system's hard drive, making it more difficult to antivirus solutions to detect it, according to the researchers. Instead, the victim's machine is infected remotely by using either exploits or remote administration tools like Windows Management Instrumentation. Once that happens, the PowerShell script is run and downloads the miner, while the virus makes a copy of itself and moves on to infect other systems in the network using the EternalBlue exploit, which was leveraged to great success by the WannaCry and NotPetya ransomware attacks last year. (See WannaCry: How the Notorious Worm Changed Ransomware.)

"The choice of fileless techniques by the cybercriminals is not accidental," Kazantsev told Security Now. "With this approach, malware leaves virtually no traces in the system, which increases the chances of a successful launch and allows to stay unnoticed longer in the system. That is why it is so important to choose security solutions that use a comprehensive approach in the fight against malware."

Malware evolution
Another characteristic of PowerGhost is its ability to run other attacks that don't involve cryptomining. According to the researchers, in one version of PowerGhost, they found a tool for running distributed denial-of-service (DDoS) attacks. The DDoS function is the only one in PowerGhost that copies files to the hard drive, making researchers believe that it probably is a test tool that will be replaced by a fileless implementation later.

"In general, the evolution of crypto miners, like with most other malware, is moving towards reducing visibility [fileless technology], long-term gaining in the systems and obtaining additional income," Kazentsev said, noting the "DDoS-module in the sample."

Such evolution in targets and capabilities has been seen other malware.

The Hide 'N Seek (HNS) botnet is an example. The botnet, which was discovered earlier this year, initially targeted Internet of Things (IoT) devices, including home routers and DVRs. Researchers at Qihoo 360's Netlab earlier this month reported that the latest versions of the HNS botnet now are taking aim at other systems, including NoSQL database servers, and include a program for mining cryptocurrencies, though the researchers don't believe the program is functional yet. (See HNS IoT Botnet Evolves, Goes Cross-Platform.)

Kazentsev added that he expects malware to continue to evolve and add more targets, saying that "the infrastructure of corporate networks is an excellent prey for owners of crypto-mining botnets, so it is likely that in the future cybercriminals will develop their own techniques and tools designed for corporate networks."

PowerGhost has a global reach to it, with instances of infection being found in North and South America, Russia and other parts of Asia, Europe and Africa. Users in India, Brazil, Colombia and Turkey, according to Kaspersky analysts.

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17452
PUBLISHED: 2020-08-09
flatCore before 1.5.7 allows upload and execution of a .php file by an admin.
CVE-2020-17451
PUBLISHED: 2020-08-09
flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.
CVE-2020-17447
PUBLISHED: 2020-08-09
MyBB before 1.8.24 allows XSS because the visual editor mishandles [align], [size], [quote], and [font] in MyCode.
CVE-2020-16248
PUBLISHED: 2020-08-09
** DISPUTED ** Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability.
CVE-2020-15820
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.