Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

6/28/2018
09:35 AM
Jeffrey Burt
Jeffrey Burt
Jeffrey Burt
50%
50%

McAfee: Cybercriminals Improving Techniques as Cryptomining Explodes

Cybercrime campaigns during the quarter showed that bad actors are improving upon the threats from last year, according to McAfee. Meanwhile, cryptomining schemes continue to skyrocket.

Cyberattacks in the first three months of the year showed that bad actors are getting more technically sophisticated in their efforts by improving upon campaigns from 2017, according to researchers at McAfee.

In addition, the use of cryptocurrency mining malware skyrocketed in the first quarter, according to McAfee's "Lab Threats Report: June 2018," confirming reports from other cybersecurity firms that threat actors are increasingly turning away from ransomware -- last year's attack of choice -- for the profitable and much less noisy cryptomining. Also in the report, McAfee analysts said there was an average of five new threat samples every second, and that there was a number of complex nation-state campaigns fueled by the desire for money, political subversion or espionage.

Cybercriminals learning from previous campaigns was a key point found in the first quarter. The McAfee researchers noted in the report that they "observed that bad actors are demonstrating a remarkable level of technical agility and innovation. Many of the attack schemes that surged toward the end of 2017 have been improved upon in creative and complex ways to avoid detection and mitigation."

Raj Samani, chief scientist at McAfee, pointed to a number of attacks between January and March that illustrated the point.

"In 2017, we saw a surge in the exploitation of benign technologies such as PowerShell," Samani told Security Now in an email. "In Q1 2018, we saw malicious actors approach such PowerShell exploits differently. For instance, cybercriminals are increasingly using .lnk shortcuts to surreptitiously deliver malicious PowerShell scripts. Such new .lnk malware schemes rose 59 percent in Q1. Gandcrab ransomware infected 50,000 systems in the first three weeks of the quarter, supplanting the Locky ransomware strains as the quarter's ransomware leader. Gandcrab uses new criminal methodologies, such as transacting ransom payments through the Dash cryptocurrency rather than through Bitcoin."

Another example was an attack during the runup to the South Korea Winter Olympic Games in which "we saw the use of steganography [a technique using hidden code] leveraged to infect/target 337 organizations," Samani wrote. "In fact, we saw this campaign adapt in flight; in other words, the malicious actors improved their tactics."

Threat actors also apparently learned from what they saw from the good guys, he said.

"They are getting better, although you can also point to the fact they follow the security community and their findings, as we saw with the use of the DDE issue reported in October and then used [by attackers] in the wild only a few weeks later," Samani wrote.

Cryptomining skyrockets
Crytpocurrency mining malware became popular among bad actors in the first quarter, according to McAfee's report, echoing findings from a growing number of cybersecurity companies, including Check Point and Symantec. McAfee itself talked about the growth in the number of cybercrimes involving cryptocurrency earlier this month in a reportdetailing how cybercriminals are using blockchain technology in their efforts. According to McAfee, the use of coin miner malware grew 629% in the first quarter. The total known samples of cryptojacking and other mining campaigns jumped from about 400,000 in the fourth quarter 2017 to more than 2.9 million during the first three months this year. (See Blockchain & Cryptocurrency Becoming Greater Security Concerns.)

Cybercriminals use malware to take over a victim's browser or steal the compute power on their system to secretly mine for cryptocurrencies, including Bitcoin, Monero and Dash. Cryptomining and similar attacks are easier to run, more efficient and less complicated than ransomware.

The rapid rise in the number of known samples "suggests that cybercriminals are warming to the prospect of monetizing infections of user systems without prompting victims to make payments, as is the case with popular ransomware schemes," Samani wrote "Compared with well-established cybercrime activities such as data theft and ransomware, cryptojacking is simpler, more straightforward and less risky. All criminals must do is infect millions of systems and start monetizing the attack by mining for cryptocurrencies on victims' systems. There are no middlemen, there are no fraud schemes, and there are no victims who need to be prompted to pay and who, potentially, may back up their systems in advance and refuse to pay."

Cryptocurrencies played a role in some nation-state campaigns, according to McAfee. Researchers pointed to the HaoBao phishing campaign perpetrated by the Lazarus Group -- an organization that cybersecurity experts believe is backed by the North Korean government and also is known as Hidden Cobra -- that targeted financial organizations and Bitcoin users around the world. The attacks used malicious email attachments that, when opened by users, embeds an implant that scans for Bitcoin activity as well as data gathering and cryptomining. (See Cybercrime Is North Korea's Biggest Threat.)

Other attacks believed to be connected to nation-states and highlighted by McAfee included Operation GhostSecret, which steals data from infected systems, and the most recent Bankshot variation of GhostSecret, which uses an embedded Adobe Flash exploit to implant malware. Hidden Cobra is believed to be behind those attacks. Gold Dragon, which was found by McAfee, targeted organizations involved in the Winter Olympics in February using a malicious Microsoft Word attachment that contained a hidden PowerShell fileless implant script. Like Olympic Destroyer, other malware aimed at the Olympics, countries like Russia and North Korea were suspected of being behind the attacks, but no groups were identified as the creators. (See Olympic Destroyer Returns With Attacks in Europe.)

Overall, the number of publicly disclosed incidents in the first quarter grew 41% year-to-year, to 313. Much of its was fueled by the rise in the cryptocurrency-related crimes, though Samani also pointed to a 10% increase in mobile malware.

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15222
PUBLISHED: 2020-09-24
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId specification say...
CVE-2020-15223
PUBLISHED: 2020-09-24
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacke...
CVE-2020-12842
PUBLISHED: 2020-09-24
ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php.
CVE-2020-12843
PUBLISHED: 2020-09-24
ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors. The magic bytes for WAV must be used.
CVE-2020-13119
PUBLISHED: 2020-09-24
ismartgate PRO 1.5.9 is vulnerable to clickjacking.