Security experts from PaloAlto Networks uncovered a large-scale crypto-currency mining operation that involved around 30 million systems worldwide.
Hackers also used the Adf.ly URL shortening service that remunerates users when someone clicks on the link. When users clicked on these Adf.ly URLs, they were redirected and found themselves downloading the crypto-currency mining malware instead.
The miner used in this Monero cryptocurrency mining operation execute XMRig mining software via VBS files, and leverages XMRig proxy services to hide the ultimate mining pool destination.
Researchers also noticed that threat actors use the Nicehash marketplace to trade hashing processing power.
According to the experts from PaloAlto the date October 20, 2017, was a milestone in this operation. Before October 20, 2017, the attackers were using the Windows built-in BITSAdmin tool to download the XMRig mining tool from a remote location. Apart from a few exceptions, the final payload was primarily installed with the filename ‘msvc.exe’.
After October 20, 2017, the experts observed attackers started using HTTP redirection services.
Since November 16, 2017, threat actors stopped using the SFX files and adopted executables compiled in Microsoft .NET Framework.
“Beginning on November 16, 2017, the attackers yet again changed tactics regarding their malware. They no longer made use of SFX files, but instead transitioned to using an executable file compiled in Microsoft .NET Framework that would write a VBS file to disk and modify the victim’s Run registry key to ensure persistence.” continues the analysis.
“The last changes we’ve seen took place in late December 2017, when the attackers yet again changed the dropper that was used to deploy the malware. Moving away from .NET, they instead create the necessary VBS file using a dropper compiled with Borland Delphi. Unlike the .NET droppers, this particular dropper will place the VBS file in the victim’s startup folder in order to obtain persistence. Otherwise, the flow of execution remains the same.”
The last samples that were using this dropper referenced a new IP address for XMRig communication( 5.23[.]48[.]207).
“Monero mining campaigns are certainly not a new development, as there have been various reported instances recently. However, it is less common to observe such a large-scale campaign go relatively unnoticed for such a long period of time. ” concluded Palo Alto.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Monero mining operation, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
