Sunday, December 10, 2023

Biggest Crypto-Mining Campaign Ever – Hackers Mine $3 Million Worth of Monero Crypto-currency

Security researchers from Checkpoint discovered a largest Monero mining activity that uses XMRig miner on various versions of Windows machines.

The hacker group earned more than $3 million worth Monero coins, and now to speed up their mining process they are targeting powerful Jenkins CI server.

Past few year Crypto currency mining is a very easy method for cyber criminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

How Attackers Inject Monero Mining Payloads

To install Monero mining payloads attackers leverage the known vulnerability CVE-2017-1000353 in the Jenkins Java deserialization implementation which accepts any serialized objects.

Attackers exploit the vulnerability by sending multiple successive session requests to CLI Interface.

Researchers said “After the first request, the second request that contains crafted packets will be sent immediately. The First request is to identify the client capabilities and the second one consist of the Monero miner payload”.
Monero mining

The malicious code initiates the hidden PowerShell to run the scripts in the background and downloads final Monero miner payload minerxmr.exe to windows servers. And later on, start command will be executed to start the mining process.

START C:\\Windows\\minerxmr.exe

Researchers said “The operation uses a hybridization of a Remote Access Trojan (RAT) and XMRig miner over the past months to target victims around the globe. The miner is capable of running on many platforms and Windows versions.”

The mining operation is well planned and executed in wild, they used a number of mining-pools to collect payments from victims, but all the funds deposited to only one wallet.As of now $3 million has been mined.

2017 is the year of data breaches and ransomware, now attackers shifted their focus to crypto mining attacks by using victims resources. Starting from the year 2018 a number of Cryptomining Attacks launched to Mine Monero Cryptocurrency.

Last week Attackers hijacked 4275 websites to inject Coinhive Monero miner including the websites of government authorities(ico.org.uk), NHS Foundation (nhs.uk), and uscourts.gov.

More than 500 million computers are mining cryptoCurrency in their browsers without the user’s knowledge and also the chrome extension started mining cryptocurrency.

Also, the Oracle Weblogic vulnerability (CVE 2017-10271) abused to run crypto miners and hijacking their processing power to mine Monero coins makes the spike in CPU usage.

IoC

Domain and IP:

  • 222[.]184[.]79[.]11
  • 183[.]136[.]202[.]244
  • btc[.]poolbt[.]com
  • shell[.]poolbt[.]com
  • xmr[.]btgirl[.]com[.]cn
  • btc[.]btgirl[.]com[.]cn

File:

  • 0bb4503cc52530ddadb102fa4010fb4d89af88aca846d4b16f601d0702134246
  • 06f8eda46fd6bdc11b8ec4d18a0f0afbf3d47f82cea8363d342975896582a715
  • f0430130a2f3549b1aeff0a9fb2246f68f585a7c1d312c7be385a1cf5f37e70d
  • c87d294cb0384cb56f4829d58cdd3f53572d3f95c2133a9b1da5f5bc1710f22f
  • f750d6da918a5f2f2c442a339821ffebcad4b61e4ca1684bac0e7df98416a794
  • 3002551eebaf486d77a2b81d87db553ad8632bb132553e306395c5da589171fe
  • 213a23219ff89c412f92aa1fdf7152178a81514014ee1cc4ffee97e725ee63a3
  • ff8c97cd55523cbdceef80407269d35bbf78abcbf807426c12d9debe1ce498d9
  • 2beaa23907c40cfcb705844f4f515ff81a788abe1aed2c8d23626d9d735968ae
  • b22fa98c3ee99222c4e827a9745f206ccf7cd40530459a92f183e148b0df5ce9
Website

Latest articles

WordPress POP Chain Flaw Exposes Over 800M+ Websites to Attack

A critical remote code execution vulnerability has been patched as part of the Wordpress...

Russian Star Blizzard New Evasion Techniques to Hijack Email Accounts

Hackers target email accounts because they contain valuable personal and financial information. Successful email...

Exploitation Methods Used by PlugX Malware Revealed by Splunk Research

PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid...

TA422 Hackers Attack Organizations Using Outlook & WinRAR Vulnerabilities

Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative...

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

Endpoint Strategies for 2024 and beyond

Converge and Defend

What's the pulse of Unified Endpoint Management and Security (UEMS) in Europe? Join us live to uncover the strategies that are defining endpoint security in the region.

Related Articles