Threat Brief: What’s Driving the Shift to Cryptocurrency Mining Malware?

save
Share and earn Cybytes
Facebook Twitter LinkedIn Email

Over the past six months, we’ve seen a major increase in the number of attack campaigns with the ultimate goal of mining cryptocurrency. It’s a subject Unit 42 has been tracking in the past year:

So, what is driving a widespread shift from attackers and creating a significant trend in the industry? There are three factors at work:

  • The price of many cryptocurrencies has increased dramatically in the last 12 months, making it more profitable to mine coins compared to other criminal business models.
  • The risk of using a compromised PC to mine cryptocurrency is currently much lower than using it for other criminal activities.
  • One particular cryptocurrency, Monero, provides its users with very high privacy and can be mined efficiently on a regular desktop or laptop PC. These properties are not true of other cryptocurrencies, like bitcoin.

To answer the question in more detail, it’s important to put yourself into the criminal’s shoes and consider what alternative routes they have to monetize infections. In this brief, we’ll share how this trend came to fruition, why it’s so prevalent, and how security professionals and defenders can keep an eye out for this rising type of threat.

 

How Attacks Monetize Infections

While targeted attacks gain the most attention from researchers and media, the majority of malware infections are untargeted and even indiscriminate. Instead of seeking out specific targets, many criminals aim to infect as many systems as possible and then turn those infections into cash. This has been true for over a decade, although the mechanisms available to criminals have shifted in that time.

To understand where we are now, it helps to look at how we got here, and to look at the evolution of common cybercriminal activities.

Back in the early 2000s, some of the earliest “botnet herders” made their income by relaying spam emails through infected computers. Over time, that business became less profitable due to anti-spam controls and ISPs preventing infected systems from directly relaying emails.

In the mid-2000s, criminals made great profits from using Banking Trojans to steal credentials for online banking websites, and subsequently draining the accounts’ associated funds. This account takeover activity continues today, but various anti-fraud measures and law enforcement actions have made it less profitable and riskier for criminals.

Another aspect of Banking Trojan infections is that, while the criminal may be infecting hosts indiscriminately, the value of the host greatly depends on the individual who owns it, and the criminals’ ability to “cash out” their bank account. Figure 1 is a capture from a book I wrote with some colleagues in 2008, “Cyber Fraud: Tactics, Techniques, and Procedures.” It shows the price that a criminal enterprise called IFRAME DOLLARS was charging to infect computers in various countries at that time.

Threat_1

Figure 1: Capture from Cyber Fraud: Tactics, Techniques, and Procedures showing prices of host infections by country.

 

In 2007, the infection of a system in Australia went for US$0.60, while an infection in Poland was only a fraction of the cost, at US$0.096. The difference in price represented the difference in value: criminals were able to make more money through a Banking Trojan account takeover from an Australian infection than they could in Poland. This was due to many factors, but chief among them was that criminals were more successful at cashing out accounts from Australian infections than they were from systems in other parts of the world.

As anti-fraud protections evolved, so did the criminals. Fast forward five years to 2013 and the rise of the Ransomware business model. This new way to generate profit had two major advantages over account takeovers:

  • Every system that is infected can be held for ransom, not just those belonging to users who also happen to bank online and have their credentials stolen.
  • Payments using cryptocurrency (primarily bitcoin) do not require interacting with banks, decreasing the risk and cost for cybercriminals of cashing out.

Put another way, the ransomware model represented both increased efficiency and decreased risk in monetizing the infection.

Anyone who’s been paying attention to cybercrime since 2013 is aware of the ransomware surge, infecting systems throughout the world and plaguing networks’ administrators. While only a tiny fraction (possibly 1 in 1000) of systems infected with a banking Trojan pay out for attackers, a much higher portion of ransomware victims pay to get their files back. While US$300 payments are less than a single account takeover could return, ransomware makes greater returns due to the volume and decreased risk in this new business model. Cybercriminals have become good business people: they saw the benefits and embraced the change.

 

Enter “The Bubble” – Where We Are Now

In the last two years, but particularly in the last six months, the price of bitcoin and other cryptocurrencies experienced a massive price surge with respect to the U.S. dollar and other fiat currencies. Here’s the chart for bitcoin over the last two years, showing a rise of 2,000% to 4,000% in the versus the U.S. dollar.

Threat_2

Figure 2: Price of bitcoin in U.S. dollars from CoinMarketCap

 

While botnets mining cryptocurrency is nothing new, the technique was much less profitable than using ransomware. In fact, with the rise of specialized bitcoin mining hardware, no regular PC can make any significant amount of money for an attacker.

However, there are many other “crypto coins” in the market today. The one we see mined most by attackers is called Monero. In contrast to bitcoin, Monero was designed to enable private transactions using a closed ledger, and its mining algorithm is still mined effectively by both PC CPUs and GPUs. As the chart below shows, Monero has risen even faster than bitcoin in price in the last two years, with more than a 30,000% gain in U.S. dollars.

Threat_3

Figure 3: Price of Monero in U.S. dollars from CoinMarketCap

 

A normal PC used to mine Monero can earn around US$0.25 per day at the current prices. That number is small, but it’s important to note that it doesn’t matter what country or network a Monero miner is part of: computers in Australia and Poland mine at the same speed. Every infected system is a profit-generating resource when mining Monero, and users are much less likely to identify their infection and remove the mining program than they would be with ransomware. For context, in January, we found a Monero mining campaign that infected around 15 million systems, largely in the developing world. If these systems remained infected for at least 24 hours each, the attackers could have earned well over 3 million U.S. dollars in Monero.

Additionally, the risk of arrest and conviction is significantly lower than with ransomware, as mining cryptocurrency is less likely to generate reports to law enforcement than a data-destroying ransomware infection.

 

What’s Next?

This wave of attacks will continue as long as it maintains a high level of profitability with a low level of risk for cybercriminals.

For defenders, it’s important to note that the techniques used to infect systems with coin mining malware are the same as they were for ransomware. Infections typically begin with emails carrying malicious macro documents, drive-by exploit kits targeting browsers, or direct attacks on servers running vulnerable software. There is no single solution to stopping these attacks, but the same technologies and policies you use to prevent other malware infections will be effective.

Across the changing landscape of botnet herders, Banking Trojans, ransomware and coin mining is one constant: the business-savvy drive to maximize profit and reduce risk. Using these as our guide, we can make sense of where we are today, how we got here, and be prepared for what has yet to develop in the future.

Here are three things to watch for:

1. A marked increase in the price of Monero or other cryptocurrencies will draw even more attackers into this business.

For many users, this could actually be a positive development, as the negative impact of having resources sapped from one’s computer is much less than paying a ransom or restoring your system from a backup due to ransomware. Conversely, a crash in the price of cryptocurrencies will decrease the profitability and drive criminals back to ransomware.

2. Listen to your fans or keep an eye on your CPU usage.

Many users realize their system is infected with coin mining malware when their laptop fans kick into high-speed mode to keep the overtaxed CPU cool. Listening to fans won’t work at the enterprise scale, but implementing widespread CPU performance monitoring could be a good way to find compromised devices. This will also help you identify the coin mining “insider threat,” as misguided administrators may see their organizations’ unused CPU time as a way to generate personal income.

3. Criminals will find ways to target these attacks.

Compromising a user’s browser or a regular home PC will net the criminal an average system for mining coins, but higher-end systems will generate more income. Attackers will soon begin targeting devices with higher specifications to get more bang for their buck. Gaming PCs with high-end GPUs and servers with large numbers of processing cores will be prime targets.

 

The post Threat Brief: What’s Driving the Shift to Cryptocurrency Mining Malware? appeared first on Palo Alto Networks Blog.

Share this post and earn Cybytes
Facebook Twitter LinkedIn Email
Follow
65 Followers
About Palo Alto Networks
Palo Alto Networks is the next-generation security company maintaining trust in the digital age by helping tens of thousands of organizations worldwide prevent cyber breaches. With our deep cybersecurity expertise, commitment to innovation, and game-changing Next-Generation Security Platform, customers can confidently pursue a digital-first strategy and embark on new technology initiatives, such as cloud and mobility. This kind of thinking and know-how helps customer organizations grow their business and empower employees all while maintaining complete visibility and the control needed to protect their critical control systems and most valued data assets. Our platform was built from the ground up for breach prevention, with threat information shared across security functions system-wide, and designed to operate in increasingly mobile, modern networks. By combining network, cloud and endpoint security with advanced threat intelligence in a natively integrated security platform, we safely enable all applications and deliver highly automated, preventive protection against cyberthreats at all stages in the attack lifecycle without compromising performance. Customers benefit from superior security to what legacy or point products provide and realize a better total cost of ownership.
Promoted Content
Unit 42 Report - Ransomware: Unlocking the Lucrative Criminal Business Model
Ransomware, specifically cryptographic ransomware, has quickly become one of the greatest cyber threats facing organizations around the world. This criminal business model has proven to be highly effective in generating revenue for cyber criminals in addition to causing significant operational impact to affected organizations. It is largely victim agnostic, spanning across the globe and affecting all major industry verticals. Small organizations, large enterprises, individual home users – everyone is a potential target. Ransomware has existed in various forms for decades, but in the last several years criminals have perfected the key components of these attacks. This has led to an explosion of new malware families and has drawn new actors into participating in these lucrative schemes.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play
 

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel