If You Thought Ransomware was Big, Illegal Crypto-Mining May be Bigger

There has been an interesting trend if you follow the daily barrage of security breaches, malware, and other related incidents. Ransomware is still a threat and getting plenty of press, but there has been a recent uptick by threat actors using the same delivery mechanisms to deploy crypto-mining malware. Once installed on a target, it remains hidden mining for electronic currency instead of blatantly asking for a ransom and causing a disruption.

Why? Simply, if the malware can remain present and undetected, the threat actors can leverage your resources over a longer period of time and potentially make even more money at a lower risk than taking your system and data hostage. Since they are “just” stealing your computing power you may not even know, and in the end, they have compromised resources potentially all over the world to create crypto-mining farms. If you need proof of this trend, look at the following articles:

• UK Government website offline after hack infects thousands more worldwide
• Cyber Espionage Group Targets Asian Countries With Bitcoin Mining Malware
• Adult content domains are home to half the sites using crypto-mining malware
• Is your computer slow lately? It could be mining Monero (XMR)
• Thousands of Government Websites Hacked to Mine Cryptocurrencies

This is an interesting new trend for 2018, and with the public hype over electronic currency, it is something that can easily create revenue for rogue nations or other sponsored threat actors. Of course, all these methods leverage vulnerabilities, exploits, social engineering, and other drive-by delivery methods already associated with other malware and threats. In order to stay protected, we need to keep our basic cybersecurity hygiene in check:

• Ensure anti-virus solutions are installed and signatures are up to date to detect and prevent this malware
• Remove end of life operating systems from your environment since they are no longer receiving security patches
• Perform regular vulnerability assessment scans to identify at-risk devices and install security patches in a timely manger
• Remove administrator rights from all workstations to prevent drive by malware
• Educate users on the risks of social engineering and how to detect a phishing or spear phishing attacks
• Leverage application control to mitigate illegal execution of applications within their environments

If we can keep these six items in pristine order from policy to operations within our organizations, the chances of becoming a host to crypto-mining malware can be minimized. Contact us today to schedule a strategy session.