Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

12/18/2018
05:31 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

When Cryptocurrency Falls, What Happens to Cryptominers?

The fall of cryptocurrency's value doesn't signify an end to cryptomining, but attackers may be more particular about when they use it.

Cryptocurrency has begun to lose its value, prompting financially motivated cybercriminals to rethink their attack strategies as the payoff for cryptojacking declines.

Cybercriminals go where the money is, and in 2018 the money was in digital currencies. Malicious cryptomining, in which attackers inject malware into target systems and hijack their power to illegally mine cryptocurrency, became the go-to attack vector. Businesses, with their plethora of vulnerable machines, became hot targets for cybercriminals looking for steady, easy money.

Ransomware attacks exchange victims' data for a lump sum of cash and there's no guarantee attackers will receive a payout. Cryptomining generates revenue, and lots of it, on a regular basis. While ransomware rose this year, cryptomining skyrocketed 629% in Q1 2018 alone, McAfee Labs reported. In Q2, cryptomining samples grew 86% to reach more than 2.5 million new ones.

"What adversaries realize is there's a reliable, dependable way to get consistent money and they really flock toward it because of that," says Cisco Talos threat researcher Nick Basini.

The mass adoption of cryptomining comes with risks. Chief among them: cryptocurrency's value. In a new report from Cisco Talos, he explains how an adversary could make $0.25 per day on a basic home computer. Now, a little more than $.04 per day can be made on the same device. Basini notes that around 75% to 85% of cryptocurrency's value has been lost throughout 2018.

"What we've really seen over the last year, and more recently over the last couple of months, is there has been a marked decrease in all cryptocurrencies," he says. Monero, the preferred digital currency among cybercriminals, has taken the hardest hit. Cybercriminals aren't abandoning cryptojacking any time soon, but they are changing their strategies, he adds.

Making Choices with Modular Malware

In a report on their research, Talos analysts report spam levels are a strong indicator of how an attack is affecting the threat landscape. Much of the spam they see is generated by botnets, and those botnets are intended to generate revenue. In early 2018, Talos saw "near constant campaigns" delivering malicious cryptominers or using a downloader.

As the year went on and cryptocurrency prices dropped, adversaries began exploring different tactics and sending different payloads. The trend, Basini says, is moving toward modular malware that lets adversaries deliver varied threats depending on the target machine. Cryptojacking is far from the only way to monetize a compromised system, he points out.

"It's a natural evolution," says Basini of the shift. "But also, adversaries have options, and in the past they didn't really have that."

Modular malware lets cybercriminals learn more about a device so they can decide how to proceed. When it lands on a machine, it collects data, like what type of hardware it is, where it's located, whether it's attached to a domain, and who owns the domain. This data could dictate the payload. A gaming machine with a lot of horsepower would be handy for cryptomining; an executive's laptop would grant access more powerful than mining would provide.

Of course, it's hard to predict the future of something as volatile as cryptocurrency. If the value of cryptocurrency goes back up, "everything goes out the window," Basini notes. For now, though, attackers are getting smarter about maximizing ROI for each of their targets.

"These types of modular malware frameworks that allow adversaries to deliver varied payloads are going to continue to rise in popularity, as the final payload can depend on a lot of external factors," Basini explains in the report.

Cryptomining Attackers: Where to Next?

In a separate post, Talos researchers dive into the activity of three separate attack groups focused on cryptomining: Rocke, 8220 Mining Group, and Tor2Mine. Early investigations mistakenly interpreted the three as being a single actor; further analysis showed three groups with similar TTPs which have amassed hundreds of thousands of US dollars combined.

Shared TTPs include malicious shell scripts disguised as JPEG files with the name "logo*.jpg" that download and execute miners. They also scan for, and attempt to exploit, recently published bugs in servers like Apache Struts 2, Oracle WebLogic, and Drupal. They use malicious scripts and malware hosted on Pastebin sites, Git repositories, and .tk top-level domains.

Researchers have been watching these groups and their cryptomining activity since early 2018, Basini says, and they are all affected by the decline in cryptocurrency's value. For example, Rocke started to develop destructive malware disguised as ransomware, an effort to diversify payloads in response to the drop in value.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
michaelmaloney
50%
50%
michaelmaloney,
User Rank: Apprentice
1/15/2019 | 12:33:53 AM
Digital risks
Any activity that happens on a digital platform has its own risks that we need to bear with similar to a real-life scenario which carries on its own some consequences. The pattern that ties the falling of cryptocurrency and cryptomining simply means that miners have to go through the ongoing hurdles before being able to either reap success or suffer losses depending on market trends.
Ritu_G
50%
50%
Ritu_G,
User Rank: Moderator
1/7/2019 | 11:59:14 PM
Sad decline
Considering how easy crypto mining sort of is, I'm surprised that there are so man people hell-bent on trying to crack the cryptocurrency codes. I mean, the whole purpose of cryptocurrencies is to make the system near unbreakable so that all of that money locked in storage is virtually untouchable. That's what Blockchain is supposed to do right? Pity though that now the price of cryptocurrencies is on the decline and that in itself is a big failure on the valuation of the success of this industry...
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.