Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

// // //
6/28/2018
09:35 AM
Jeffrey Burt
Jeffrey Burt
Jeffrey Burt

McAfee: Cybercriminals Improving Techniques as Cryptomining Explodes

Cybercrime campaigns during the quarter showed that bad actors are improving upon the threats from last year, according to McAfee. Meanwhile, cryptomining schemes continue to skyrocket.

Cyberattacks in the first three months of the year showed that bad actors are getting more technically sophisticated in their efforts by improving upon campaigns from 2017, according to researchers at McAfee.

In addition, the use of cryptocurrency mining malware skyrocketed in the first quarter, according to McAfee's "Lab Threats Report: June 2018," confirming reports from other cybersecurity firms that threat actors are increasingly turning away from ransomware -- last year's attack of choice -- for the profitable and much less noisy cryptomining. Also in the report, McAfee analysts said there was an average of five new threat samples every second, and that there was a number of complex nation-state campaigns fueled by the desire for money, political subversion or espionage.

(Source: Pixabay)
(Source: Pixabay)

Cybercriminals learning from previous campaigns was a key point found in the first quarter. The McAfee researchers noted in the report that they "observed that bad actors are demonstrating a remarkable level of technical agility and innovation. Many of the attack schemes that surged toward the end of 2017 have been improved upon in creative and complex ways to avoid detection and mitigation."

Raj Samani, chief scientist at McAfee, pointed to a number of attacks between January and March that illustrated the point.

"In 2017, we saw a surge in the exploitation of benign technologies such as PowerShell," Samani told Security Now in an email. "In Q1 2018, we saw malicious actors approach such PowerShell exploits differently. For instance, cybercriminals are increasingly using .lnk shortcuts to surreptitiously deliver malicious PowerShell scripts. Such new .lnk malware schemes rose 59 percent in Q1. Gandcrab ransomware infected 50,000 systems in the first three weeks of the quarter, supplanting the Locky ransomware strains as the quarter's ransomware leader. Gandcrab uses new criminal methodologies, such as transacting ransom payments through the Dash cryptocurrency rather than through Bitcoin."

Another example was an attack during the runup to the South Korea Winter Olympic Games in which "we saw the use of steganography [a technique using hidden code] leveraged to infect/target 337 organizations," Samani wrote. "In fact, we saw this campaign adapt in flight; in other words, the malicious actors improved their tactics."

Threat actors also apparently learned from what they saw from the good guys, he said.

"They are getting better, although you can also point to the fact they follow the security community and their findings, as we saw with the use of the DDE issue reported in October and then used [by attackers] in the wild only a few weeks later," Samani wrote.

Cryptomining skyrockets
Crytpocurrency mining malware became popular among bad actors in the first quarter, according to McAfee's report, echoing findings from a growing number of cybersecurity companies, including Check Point and Symantec. McAfee itself talked about the growth in the number of cybercrimes involving cryptocurrency earlier this month in a reportdetailing how cybercriminals are using blockchain technology in their efforts. According to McAfee, the use of coin miner malware grew 629% in the first quarter. The total known samples of cryptojacking and other mining campaigns jumped from about 400,000 in the fourth quarter 2017 to more than 2.9 million during the first three months this year. (See Blockchain & Cryptocurrency Becoming Greater Security Concerns.)

Cybercriminals use malware to take over a victim's browser or steal the compute power on their system to secretly mine for cryptocurrencies, including Bitcoin, Monero and Dash. Cryptomining and similar attacks are easier to run, more efficient and less complicated than ransomware.

(Source: McAfee)
(Source: McAfee)

The rapid rise in the number of known samples "suggests that cybercriminals are warming to the prospect of monetizing infections of user systems without prompting victims to make payments, as is the case with popular ransomware schemes," Samani wrote "Compared with well-established cybercrime activities such as data theft and ransomware, cryptojacking is simpler, more straightforward and less risky. All criminals must do is infect millions of systems and start monetizing the attack by mining for cryptocurrencies on victims' systems. There are no middlemen, there are no fraud schemes, and there are no victims who need to be prompted to pay and who, potentially, may back up their systems in advance and refuse to pay."

Cryptocurrencies played a role in some nation-state campaigns, according to McAfee. Researchers pointed to the HaoBao phishing campaign perpetrated by the Lazarus Group -- an organization that cybersecurity experts believe is backed by the North Korean government and also is known as Hidden Cobra -- that targeted financial organizations and Bitcoin users around the world. The attacks used malicious email attachments that, when opened by users, embeds an implant that scans for Bitcoin activity as well as data gathering and cryptomining. (See Cybercrime Is North Korea's Biggest Threat.)

Other attacks believed to be connected to nation-states and highlighted by McAfee included Operation GhostSecret, which steals data from infected systems, and the most recent Bankshot variation of GhostSecret, which uses an embedded Adobe Flash exploit to implant malware. Hidden Cobra is believed to be behind those attacks. Gold Dragon, which was found by McAfee, targeted organizations involved in the Winter Olympics in February using a malicious Microsoft Word attachment that contained a hidden PowerShell fileless implant script. Like Olympic Destroyer, other malware aimed at the Olympics, countries like Russia and North Korea were suspected of being behind the attacks, but no groups were identified as the creators. (See Olympic Destroyer Returns With Attacks in Europe.)

Overall, the number of publicly disclosed incidents in the first quarter grew 41% year-to-year, to 313. Much of its was fueled by the rise in the cryptocurrency-related crimes, though Samani also pointed to a 10% increase in mobile malware.

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Developing and Testing an Effective Breach Response Plan
Whether or not a data breach is a disaster for the organization depends on the security team's response and that is based on how the team developed a breach response plan beforehand and if it was thoroughly tested. Inside this report, experts share how to: -understand the technical environment, -determine what types of incidents would trigger the plan, -know which stakeholders need to be notified and how to do so, -develop steps to contain the breach, collect evidence, and initiate recovery.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-39044
PUBLISHED: 2022-12-07
Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command. The affected products/versions are as follows: WCR-300 firmware Ver. 1.87 and earlier, WHR-HP-G300N firmware Ver. 2.00 and ea...
CVE-2022-40966
PUBLISHED: 2022-12-07
Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and access the device. The affected products/versions are as follows: WCR-300 firmware Ver. 1.87 and earlier, WHR-HP-G300N firmware Ver. 2.00 and earlier, WHR-HP-GN fir...
CVE-2022-42458
PUBLISHED: 2022-12-07
Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered.
CVE-2022-45910
PUBLISHED: 2022-12-07
Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries (DoS, additional queries, filter manipulation) durin...
CVE-2022-34840
PUBLISHED: 2022-12-07
Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the device. The affected products/versions are as follows: WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600...