If You Thought Ransomware was Big, Illegal Crypto-Mining May be Bigger

Morey Haber, Chief Technology Officer
February 12th, 2018

Crypto-mining

There has been an interesting trend if you follow the daily barrage of security breaches, malware, and other related incidents. Ransomware is still a threat and getting plenty of press, but there has been a recent uptick by threat actors using the same delivery mechanisms to deploy crypto-mining malware. Once installed on a target, it remains hidden mining for electronic currency instead of blatantly asking for a ransom and causing a disruption.

Why? Simply, if the malware can remain present and undetected, the threat actors can leverage your resources over a longer period of time and potentially make even more money at a lower risk than taking your system and data hostage. Since they are “just” stealing your computing power you may not even know, and in the end, they have compromised resources potentially all over the world to create crypto-mining farms. If you need proof of this trend, look at the following articles:

This is an interesting new trend for 2018, and with the public hype over electronic currency, it is something that can easily create revenue for rogue nations or other sponsored threat actors. Of course, all these methods leverage vulnerabilities, exploits, social engineering, and other drive-by delivery methods already associated with other malware and threats. In order to stay protected, we need to keep our basic cybersecurity hygiene in check:

  • Ensure anti-virus solutions are installed and signatures are up to date to detect and prevent this malware
  • Remove end of life operating systems from your environment since they are no longer receiving security patches
  • Perform regular vulnerability assessment scans to identify at-risk devices and install security patches in a timely manger
  • Remove administrator rights from all workstations to prevent drive by malware
  • Educate users on the risks of social engineering and how to detect a phishing or spear phishing attacks
  • Leverage application control to mitigate illegal execution of applications within their environments

If we can keep these six items in pristine order from policy to operations within our organizations, the chances of becoming a host to crypto-mining malware can be minimized. Contact us today to schedule a strategy session.

Morey Haber, Chief Technology Officer

With more than 20 years of IT industry experience and author of Privileged Attack Vectors, Mr. Haber joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. He currently oversees BeyondTrust technology for both vulnerability and privileged access management solutions. In 2004, Mr. Haber joined eEye as the Director of Security Engineering and was responsible for strategic business discussions and vulnerability management architectures in Fortune 500 clients. Prior to eEye, he was a Development Manager for Computer Associates, Inc. (CA), responsible for new product beta cycles and named customer accounts. Mr. Haber began his career as a Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelors of Science in Electrical Engineering from the State University of New York at Stony Brook.