The cryptocurrency boom has led to cyber threat actors adopting unauthorized and illegal ways to get their hands on cryptocurrencies. While ransomware primarily demand ransom in the form of Bitcoin, the first cryptocurrency— to ‘unblock’ access to system/files— a crypto malware is designed to mine cryptocurrencies from systems without the users’ knowledge
For the unversed, cryptocurrencies and blockchain—the decentralized ledger technology that powers cryptocurrencies—are regarded as one the most significant evolutionary paradigms among internet technologies. Generally speaking, cryptocurrencies tokenize value pertaining to a piece of technology or novelty. Like the widely known cryptocurrencies like Bitcoin and Ether, many cryptocurrencies exist, with many being introduced every year. To put things in perspective, according to Statista, there were just about 66 cryptocurrencies in 2013.
That number stands above 8000 as of December 2021. Full-blown crypto trading and finance ecosystems continue to thrive in the Web 3.0 (the term for the next evolutionary version of the internet) sphere.
Similar to traditional money being printed in correlation to its value against an asset (mainly gold), most cryptocurrencies are ‘mined’ as a reward for algorithmically solving computer puzzles.
The ‘asset’ here is the computer processing power utilized to solve the puzzles. Mining is done through a virtual mining rig, a combination of processing hardware like graphical card units and purpose-built mining software.
The more cryptocurrencies one possesses, the more the wealth or potential wealth.
That said, crypto-malware leverage the compute/processing power of the victim’s system(s) to mine cryptocurrencies. Today, as the processing power and hardware expenses to mine cryptocurrencies like Bitcoin are astronomical, crypto-malware is gaining more popularity among cybercriminals.
Crypto malware, also known as crypto-mining malware, is malicious software installed by threat actors on victims’ devices. It allows threat actors to mine cryptocurrencies using the victim’s computing resources without their knowledge. This is also known as ‘cryptojacking,’ where victims don’t get any payoff while suffering severe losses in terms of computational resources and processing power. A successful organization-wide cryptojacking attempt can reap enormous rewards for the cyber perpetrators
People tend to confuse crypto malware with crypto ransomware. The method and path that both these threats adopt to enter a victim’s system are more or less the same, but they are radically very different from each other. While crypto malware uses a victim’s computational resources to mine cryptocurrencies, crypto ransomware is a malware that allows the attacker to encrypt the files stored on the victim’s device to extort money, mainly in the form of cryptocurrency.
The victim of a crypto ransomware attack is instantly notified by the threat actor that their systems/files are compromised, followed by a ransom note. On the other hand, the objective of crypto malware is to operate undetected. The longer, the better.
Crypto malware enters the victim’s system like any other malware. For instance, they are often delivered as email attachments that may be executable programs in the guise of documents.
The attackers may even use psychological and social engineering tactics to persuade the users to download and execute the malicious files.
Most of these messages seem legitimate and create a sense of urgency or panic in the users’ minds making them think that downloading the file is essential.
Once the file is opened, codes are executed via JavaScript or Macros to download and install the malware.
Malware is also deployed via exploit kits, malicious landing pages, infected websites, malvertising, and more. Sometimes the attacker can cryptojack by prompting the user to visit a website with JavaScript code that auto-executes once loaded.
These types of attacks are hard to detect since the malicious codes are stored on the website.
Instead of directly ‘attacking/corrupting’ the data, crypto-malware embeds malicious code into applications and programs to use the GPUs and other resources on the system for cryptojacking. It runs silently in the background, mining cryptocurrencies whenever the infected device is being used.
Botnets are a network of private computers infected with malware and controlled as a group without the owners’ knowledge. The Prometei botnet came to light during the mid-2020, and they exploited Microsoft Exchange Vulnerabilities to deploy crypto malware. It usually mined the Monero cryptocurrency, which is currently worth around $200. The Prometei Botnet infected many companies’ networks across many industries in North America and Europe. In addition to mining cryptocurrencies, it leverages known exploits such as EternalBlue and BlueKeep to harvest credentials. It uses SMB and RDP exploits to spread and install mining components on many endpoints.
PowerGhost uses spear-phishing to gain initial access to a network. It expertly evades detection and spreads by leveraging Windows Management Instrumentation and the EternalBlue exploit. Upping the cryptojacking game, it is capable of disabling antivirus programs and other competing cryptocurrency miners to obtain the maximum yield.
Graboid is the first ever cryptojacking worm that spreads through Docker Engine, an open source containerization technology for building and containerizing applications on the cloud. It gains ‘foothold’ through unsecured Docker daemons, where it installs a Docker image that runs on the compromised host to mine the Monero cryptocurrency.
For all its intents and purposes, crypto malware prioritizes undetectability. However, users can suspect its presence if their systems/system components show the following ‘symptoms,’
Since crypto-malware is essentially malware, methods that prevent malware attacks can take users a long way in staying protected against crypto-malware.
Some of them include:
Crypto malware attacks are gaining momentum due to the increasing popularity and demand for cryptocurrencies. They are built to avoid detection and use computer resources in an unauthorized manner to mine cryptocurrencies (cryptojacking.)
Crypto malware is not something to be overlooked as it exposes your devices to threat actors who might target your data in the future. Not to mention it leads to the uncontrolled use of your computational resources and power. Even though cryptojacking is still in its infancy, businesses must ensure adequate measures are taken to prevent crypto-malware attacks. They should also have the informed (educated) intuition to detect them.
A blueprint for combatting ransomware in the manufacturing industry
Insider threats are becoming center stage to some of the deadliest cyberattacks in recent news.
Novacommand can help detect threats by inspecting and analyzing the network traffic. The information about the network traffic (metadata) will be correlated and analyzed as well.
By doing this, threats can be detected in an early stage by their behavior, destination, or a combination of both.
Novacommand will not ‘defend’ you against threats but will alarm you on a threat and if needed initiate an action with a 3rd party integration like a firewall or EPP.
Some malware (crypto malware) allows attackers to mine cryptocurrencies by leveraging your mobile’s computational resources like GPUs. The malware may be installed on your phone when you visit a malicious website, or when you download and open files from unknown sources.
Crypto malware often drains the computational resources on your device. Sudden issues with your graphics card, memory, processors, and system slowdown might be signs of a crypto-malware attack.
Crypto malware and ransomware spread just like any other malware. They are usually spread via misleading and potentially dangerous email messages that might look legitimate.
