2018: The rise of Cryptominers

They’re everywhere. Really. Everywhere. And if you don’t think they’re on your systems, think again. In the first 3 months of 2018, unique cryptominer types increased from 93,750 to over 127,000.  Compare that to ransomware, which was doing a booming business from 2016 into 2017.  New ransomware variants actually declined from 124,320 to 71,540.  Exploit kits are also down. That’s significant, because cybercrime is all about efficiency and profit. Illegal or malicious cyrptominers have evolved from a nuisance infecting individual systems to a pervasive threat on enterprise systems.

Per researchers at Cisco TALOS

“The number of ways adversaries are delivering miners to end users is staggering. It is reminiscent of the explosion of ransomware we saw several years ago. This is indicative of a major shift in the types of payloads adversaries are trying to deliver. It helps show that the effectiveness of ransomware as a payload is limited. It will always be effective to ransom specific organizations or to use in targeted attacks, but as a payload to compromise random victims its reach definitely has limits. At some point the pool of potential victims becomes too small to generate the revenue expected.”

The lure of easy money is unmistakable. Cryptominers offer “continuous passive income” versus the risk of not getting a ransom with ransomware.  And you can’t beat the return on investment. It’s pretty much pure profit, since the miners use somebody else’s resources.

The trend actually took hold in 2017, and has not stopped escalating. ZScaler reports it blocked more than 2.5 billion attempts over the past 6 months. On April 12, Infosecurity Magazine reported that cryptomining spiked 500% on corporate networks.  This is no longer a single-machine effort, but a massive, coordinated hunt by botnets for vulnerable systems. Researchers report that within the space of 24 hours, attackers tried to compromise 30% of networks globally using botnets to find vulnerable servers and web applications. PATCH people!

Mining is resource-intensive.   Monero has moved past what standard user systems can supply. Now, it requires graphics cards or preferably application specific integrated circuit ASIC chips.  We’re seeing miners shift to mining alternative currencies to Monero that can be mined using any CPU.

The impact is significant in terms of wear and tear on hardware. Miners usurp corporate bandwidth. They cause performance issues, and we know that uptime must be all the time. What enterprises should also take note of is that they could be at risk of compliance violations because of the unidentified activity on their corporate systems.

PIVOTS:  In 2016, we saw ransomware pivot and morph from attacking individuals to leveraging vulnerabilities on servers and networks and attacking institutions. We’re seeing the same thing happen with cryptominers, as criminals discover how to make better money, faster. They are hunting for web servers and applications they can exploit via unpatched vulnerabilities, both old and new.  Once they can compromise a system, they install the mining software.

Now, it appears that criminals are repurposing malware as miners, which is not a good thing when that malware happens to be ransomware. Case in point: XiaoBa. Researchers at Trend Micro report this new variation was not modified well, so that it is destructive. The sloppy code destroys files and crashes PCs. While his isn’t widespread, and will likely be reworked, the damage has been done to numerous systems. And raises the bigger issue: what will attackers rework next, and whose systems will be at risk?

MINERS: The one to watch for is Coinhive, as the most impact and pervasive.

BOTNETS:  Smominru: this is one of the biggest, most successful cryptojacking botnets active. So far, it’s netted $2.3 billion by leveraging the EternalBlue exploit to infect and enslave computers as part of the botnet. At more than half a million bots, the system is massive, and had evaded sinkhole attempts against it.

TARGETS: Because browsing time by users is high, nudity/porn sites, or those with streaming media, offer the most value for miners. However professional and marketing services are also rating high, bringing miners onto corporate networks.

Android and mobile systems: Kaspersky reports they found malicious mining apps in the Google Play store, imitating legitimate apps like games and VPNs, and notably sports streaming apps.  Some of these were downloaded over 100,000 times.  The criminals know this is a numbers game, because mobiles aren’t high performance and the risk of detection is higher.   Mining has become a frequent topic on darkweb forums, as members share knowledge, experiences and advice to improve their success.

Coinhive has evolved over time. Numerous compromised sites use JavaScript obfuscation and the final code presents itself as Google Analytics JS to viewers.

ATTACKS:  ZEALOT was discovered by researchers at F5 in late 2017.  This Monero cryptominer installed itself on vulnerable Apache Struts systems, leveraging the EternalBlue and EternalSynergy exploits.  PATCH, people!

A recent attack is leveraging an older ISS vulnerability on Windows servers. Microsoft was going to let IIS Internet Information Services 6.0 run its course and die. But there was a WebDAV exploit posted on GitHub in March 2017.  The vulnerability, CVE-2017-7269, is very similar to the NSA “Explodingcan” exploit that was part of the infamous Shadow Broker’s Good Friday dump. Attackers used that flaw to install cryptominers.  We all know that once a vulnerability is made known, attackers pounce and exploits follow.  In this case, the exploits has a new ASCII shellcode that contains a return ortiented programming ROP chain. This uses instructions that are already loaded in memory, so there is no need to write or execute further external code.  This enables the attackers to bypass security mechanisms, like executable space protections and code signing.

Lateral movement. Those two words should scare every security analyst. It’s what we fight to prevent. We don’t want the attacker to get to move through our networks and gather data. But this is the hallmark of sophisticated ransomware attacks on enterprises, and it’s now part of cryptominers.  In a report by Red Canary, they detail how an adversary mixed lateral movement with cryptomining on a Windows system. We know there are processes to watch over very, very carefully in Windows. In this case, they found numerous Windows command shells that were spawning from the Local Security Authority Subsystem process, lsass.exe.  This process handles user authentication for a system and typically does not have child processes. Authentication is a crown jewel so anything impacting this is critical.  The child processes that would spawn would inherit major privilege and have unrestricted access to the local system. Hello, lateral movement. This is the threat to enterprise systems we need to be monitoring.

PROTECTION:  Set up a web application firewall infront of all applications.  Keep your system patched and up to date. And monitor system performance for even small impacts.  There are numerous threat intel teams now tracking the mining bots and sharing IOCs, as in the link below from Proofpoint. That is the beauty of the security community at work.  Security teams can use this info to ensure their networks are not communicating with mining bots. Because all that glitters is not gold – it’s bitcoin.

 

ZDNet 04/05/2018 D. Palmer
Red Canary:  T. Lambert April 4
darkreading 4/5/2018 T. Kreikemeier
Comodo Cybersecurity Threat Research Labs Q1 Global Malware Report
https://www.tripwire.com/state-of-security/featured/smominru-half-million-pcs-hit-cryptomining-botnet/
https://www.proofpoint.com/us/threat-insight/post/smominru-monero-mining-botnet-making-millions-operators
https://www.bleepingcomputer.com/news/security/xiaoba-ransomware-retooled-as-coinminer-but-manages-to-ruin-your-files-anyway/
https://www.helpnetsecurity.com/2018/04/12/cryptomining-enterprise/

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s