Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

// // //
6/28/2018
09:35 AM
Jeffrey Burt
Jeffrey Burt
Jeffrey Burt

McAfee: Cybercriminals Improving Techniques as Cryptomining Explodes

Cybercrime campaigns during the quarter showed that bad actors are improving upon the threats from last year, according to McAfee. Meanwhile, cryptomining schemes continue to skyrocket.

Cyberattacks in the first three months of the year showed that bad actors are getting more technically sophisticated in their efforts by improving upon campaigns from 2017, according to researchers at McAfee.

In addition, the use of cryptocurrency mining malware skyrocketed in the first quarter, according to McAfee's "Lab Threats Report: June 2018," confirming reports from other cybersecurity firms that threat actors are increasingly turning away from ransomware -- last year's attack of choice -- for the profitable and much less noisy cryptomining. Also in the report, McAfee analysts said there was an average of five new threat samples every second, and that there was a number of complex nation-state campaigns fueled by the desire for money, political subversion or espionage.

(Source: Pixabay)
(Source: Pixabay)

Cybercriminals learning from previous campaigns was a key point found in the first quarter. The McAfee researchers noted in the report that they "observed that bad actors are demonstrating a remarkable level of technical agility and innovation. Many of the attack schemes that surged toward the end of 2017 have been improved upon in creative and complex ways to avoid detection and mitigation."

Raj Samani, chief scientist at McAfee, pointed to a number of attacks between January and March that illustrated the point.

"In 2017, we saw a surge in the exploitation of benign technologies such as PowerShell," Samani told Security Now in an email. "In Q1 2018, we saw malicious actors approach such PowerShell exploits differently. For instance, cybercriminals are increasingly using .lnk shortcuts to surreptitiously deliver malicious PowerShell scripts. Such new .lnk malware schemes rose 59 percent in Q1. Gandcrab ransomware infected 50,000 systems in the first three weeks of the quarter, supplanting the Locky ransomware strains as the quarter's ransomware leader. Gandcrab uses new criminal methodologies, such as transacting ransom payments through the Dash cryptocurrency rather than through Bitcoin."

Another example was an attack during the runup to the South Korea Winter Olympic Games in which "we saw the use of steganography [a technique using hidden code] leveraged to infect/target 337 organizations," Samani wrote. "In fact, we saw this campaign adapt in flight; in other words, the malicious actors improved their tactics."

Threat actors also apparently learned from what they saw from the good guys, he said.

"They are getting better, although you can also point to the fact they follow the security community and their findings, as we saw with the use of the DDE issue reported in October and then used [by attackers] in the wild only a few weeks later," Samani wrote.

Cryptomining skyrockets
Crytpocurrency mining malware became popular among bad actors in the first quarter, according to McAfee's report, echoing findings from a growing number of cybersecurity companies, including Check Point and Symantec. McAfee itself talked about the growth in the number of cybercrimes involving cryptocurrency earlier this month in a reportdetailing how cybercriminals are using blockchain technology in their efforts. According to McAfee, the use of coin miner malware grew 629% in the first quarter. The total known samples of cryptojacking and other mining campaigns jumped from about 400,000 in the fourth quarter 2017 to more than 2.9 million during the first three months this year. (See Blockchain & Cryptocurrency Becoming Greater Security Concerns.)

Cybercriminals use malware to take over a victim's browser or steal the compute power on their system to secretly mine for cryptocurrencies, including Bitcoin, Monero and Dash. Cryptomining and similar attacks are easier to run, more efficient and less complicated than ransomware.

(Source: McAfee)
(Source: McAfee)

The rapid rise in the number of known samples "suggests that cybercriminals are warming to the prospect of monetizing infections of user systems without prompting victims to make payments, as is the case with popular ransomware schemes," Samani wrote "Compared with well-established cybercrime activities such as data theft and ransomware, cryptojacking is simpler, more straightforward and less risky. All criminals must do is infect millions of systems and start monetizing the attack by mining for cryptocurrencies on victims' systems. There are no middlemen, there are no fraud schemes, and there are no victims who need to be prompted to pay and who, potentially, may back up their systems in advance and refuse to pay."

Cryptocurrencies played a role in some nation-state campaigns, according to McAfee. Researchers pointed to the HaoBao phishing campaign perpetrated by the Lazarus Group -- an organization that cybersecurity experts believe is backed by the North Korean government and also is known as Hidden Cobra -- that targeted financial organizations and Bitcoin users around the world. The attacks used malicious email attachments that, when opened by users, embeds an implant that scans for Bitcoin activity as well as data gathering and cryptomining. (See Cybercrime Is North Korea's Biggest Threat.)

Other attacks believed to be connected to nation-states and highlighted by McAfee included Operation GhostSecret, which steals data from infected systems, and the most recent Bankshot variation of GhostSecret, which uses an embedded Adobe Flash exploit to implant malware. Hidden Cobra is believed to be behind those attacks. Gold Dragon, which was found by McAfee, targeted organizations involved in the Winter Olympics in February using a malicious Microsoft Word attachment that contained a hidden PowerShell fileless implant script. Like Olympic Destroyer, other malware aimed at the Olympics, countries like Russia and North Korea were suspected of being behind the attacks, but no groups were identified as the creators. (See Olympic Destroyer Returns With Attacks in Europe.)

Overall, the number of publicly disclosed incidents in the first quarter grew 41% year-to-year, to 313. Much of its was fueled by the rise in the cryptocurrency-related crimes, though Samani also pointed to a 10% increase in mobile malware.

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-23463
PUBLISHED: 2022-09-24
Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes suc...
CVE-2022-23464
PUBLISHED: 2022-09-24
Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information...
CVE-2022-23461
PUBLISHED: 2022-09-24
Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.
CVE-2022-36025
PUBLISHED: 2022-09-24
Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incor...
CVE-2022-39240
PUBLISHED: 2022-09-24
MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Execution. This issue is patched in version 1.0.4. There is no known workaround.