There has been an interesting trend if you follow the daily barrage of security breaches, malware, and other related incidents. Ransomware is still a threat and getting plenty of press, but there has been a recent uptick by threat actors using the same delivery mechanisms to deploy crypto-mining malware. Once installed on a target, it remains hidden mining for electronic currency instead of blatantly asking for a ransom and causing a disruption.
Why? Simply, if the malware can remain present and undetected, the threat actors can leverage your resources over a longer period of time and potentially make even more money at a lower risk than taking your system and data hostage. Since they are “just” stealing your computing power you may not even know, and in the end, they have compromised resources potentially all over the world to create crypto-mining farms. If you need proof of this trend, look at the following articles:
- UK Government website offline after hack infects thousands more worldwide
- Cyber Espionage Group Targets Asian Countries With Bitcoin Mining Malware
- Adult content domains are home to half the sites using crypto-mining malware
- Is your computer slow lately? It could be mining Monero (XMR)
- Thousands of Government Websites Hacked to Mine Cryptocurrencies
This is an interesting new trend for 2018, and with the public hype over electronic currency, it is something that can easily create revenue for rogue nations or other sponsored threat actors. Of course, all these methods leverage vulnerabilities, exploits, social engineering, and other drive-by delivery methods already associated with other malware and threats. In order to stay protected, we need to keep our basic cybersecurity hygiene in check:
- Ensure anti-virus solutions are installed and signatures are up to date to detect and prevent this malware
- Remove end of life operating systems from your environment since they are no longer receiving security patches
- Perform regular vulnerability assessment scans to identify at-risk devices and install security patches in a timely manger
- Remove administrator rights from all workstations to prevent drive by malware
- Educate users on the risks of social engineering and how to detect a phishing or spear phishing attacks
- Leverage application control to mitigate illegal execution of applications within their environments
If we can keep these six items in pristine order from policy to operations within our organizations, the chances of becoming a host to crypto-mining malware can be minimized. Contact us today to schedule a strategy session.
Morey J. Haber, Chief Technology Officer and Chief Information Security Officer at BeyondTrust
Morey J. Haber is Chief Technology Officer and Chief Information Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored four Apress books: Privileged Attack Vectors (2 Editions), Asset Attack Vectors, and Identity Attack Vectors. In 2018, Bomgar acquired BeyondTrust and retained the BeyondTrust name. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. Morey currently oversees BeyondTrust strategy for privileged access management and remote access solutions. In 2004, he joined eEye as Director of Security Engineering and was responsible for strategic business discussions and vulnerability management architectures in Fortune 500 clients. Prior to eEye, he was Development Manager for Computer Associates, Inc. (CA), responsible for new product beta cycles and named customer accounts. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.