Cybercriminals have started using sophisticated infection methods and techniques borrowed from targeted attacks to install mining software on attacked PCs within organisations, according to Kaspersky Lab. The most successful group observed by the cyber security product company earned at least £5m by exploiting their victims in just six months during 2017.
Although the cryptocurrency market is experiencing ups and downs, last year’s phenomena with surges in the value of Bitcoin has changed not only global economics, but the world of cybersecurity too, the cyber firm says. With the aim of earning cryptocurrency, criminals have started to use mining software in their attacks, which, like ransomware, has a simple monetisation model. But, unlike ransomware, it doesn’t destructively harm users and is able to stay undetected for a long time by silently using the PC’s power. Back in September 2017, Kaspersky Lab recorded a rise of miners that started actively spreading across the world, and predicted its further development. The latest research reveals that this growth has not only continued, but has also increased and extended.
The Lab researchers recently identified a cybercriminal group with APT-techniques in their arsenal of tools to infect users with miners. They have been using the process-hollowing method that is usually used in malware and has been seen in some targeted attacks of APT actors, but has never been observed in mining attacks before.
The attack works like this: the victim is lured into downloading and installing an advertisement software with the miner installer hidden inside. This installer drops a legitimate Windows utility, with the main purpose being to download the miner itself from a remote server. After its execution, a legitimate system process starts, and the legitimate code of this process is changed to malicious code. As a result, the miner operates under the guise of a legitimate task, so it will be impossible for a user to recognise if there is a mining infection. It is also challenging for security solutions to detect this threat. In addition, miners mark this new process through the way it restricts any task cancellation. If the user tries to stop the process, the computer system will reboot. As a result, criminals protect their presence in the system for a longer and more productive time.
Kaspersky suggests that the actors behind these attacks have been mining Electroneum coins and earned almost £5 million during the second half of 2017, which is comparable to the sums that ransomware creators used to earn.
Anton Ivanov, Lead Malware Analyst at Kaspersky Lab, said: “We see that ransomware is fading into the background, instead giving way to miners. This is confirmed by our statistics, which show a steady growth of miners throughout the year, as well as by the fact that cybercriminals groups are actively developing their methods and have already started to use more sophisticated techniques to spread mining software. We have already seen such an evolution – ransomware hackers were using the same tricks when they were on the rise.”
