There has been an interesting trend if you follow the daily barrage of security breaches, malware, and other related incidents. Ransomware is still a threat and getting plenty of press, but there has been a recent uptick by threat actors using the same delivery mechanisms to deploy crypto-mining malware. Once installed on a target, it remains hidden mining for electronic currency instead of blatantly asking for a ransom and causing a disruption.
Why? Simply, if the malware can remain present and undetected, the threat actors can leverage your resources over a longer period of time and potentially make even more money at a lower risk than taking your system and data hostage. Since they are “just” stealing your computing power you may not even know, and in the end, they have compromised resources potentially all over the world to create crypto-mining farms. If you need proof of this trend, look at the following articles:
- UK Government website offline after hack infects thousands more worldwide
- Cyber Espionage Group Targets Asian Countries With Bitcoin Mining Malware
- Adult content domains are home to half the sites using crypto-mining malware
- Is your computer slow lately? It could be mining Monero (XMR)
- Thousands of Government Websites Hacked to Mine Cryptocurrencies
This is an interesting new trend for 2018, and with the public hype over electronic currency, it is something that can easily create revenue for rogue nations or other sponsored threat actors. Of course, all these methods leverage vulnerabilities, exploits, social engineering, and other drive-by delivery methods already associated with other malware and threats. In order to stay protected, we need to keep our basic cybersecurity hygiene in check:
- Ensure anti-virus solutions are installed and signatures are up to date to detect and prevent this malware
- Remove end of life operating systems from your environment since they are no longer receiving security patches
- Perform regular vulnerability assessment scans to identify at-risk devices and install security patches in a timely manger
- Remove administrator rights from all workstations to prevent drive by malware
- Educate users on the risks of social engineering and how to detect a phishing or spear phishing attacks
- Leverage application control to mitigate illegal execution of applications within their environments
If we can keep these six items in pristine order from policy to operations within our organizations, the chances of becoming a host to crypto-mining malware can be minimized. Contact us today to schedule a strategy session.
Morey J. Haber, Chief Security Officer, BeyondTrust
Morey J. Haber is the Chief Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored three books: Privileged Attack Vectors, Asset Attack Vectors, and Identity Attack Vectors. He is a founding member of the industry group Transparency in Cyber, and in 2020 was elected to the Identity Defined Security Alliance (IDSA) Executive Advisory Board. Morey currently oversees BeyondTrust security and governance for corporate and cloud based solutions and regularly consults for global periodicals and media. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition where he served as a Product Owner and Solutions Engineer since 2004. Prior to eEye, he was Beta Development Manager for Computer Associates, Inc. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.
