Security researchers from Checkpoint discovered a largest Monero mining activity that uses XMRig miner on various versions of Windows machines.

The hacker group earned more than $3 million worth Monero coins, and now to speed up their mining process they are targeting powerful Jenkins CI server.

Past few year Crypto currency mining is a very easy method for cyber criminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

How Attackers Inject Monero Mining Payloads

To install Monero mining payloads attackers leverage the known vulnerability CVE-2017-1000353 in the Jenkins Java deserialization implementation which accepts any serialized objects.

Attackers exploit the vulnerability by sending multiple successive session requests to CLI Interface.

Researchers said “After the first request, the second request that contains crafted packets will be sent immediately. The First request is to identify the client capabilities and the second one consist of the Monero miner payload”.

The malicious code initiates the hidden PowerShell to run the scripts in the background and downloads final Monero miner payload minerxmr.exe to windows servers. And later on, start command will be executed to start the mining process.

START C:\\Windows\\minerxmr.exe

Researchers said “The operation uses a hybridization of a Remote Access Trojan (RAT) and XMRig miner over the past months to target victims around the globe. The miner is capable of running on many platforms and Windows versions.”

The mining operation is well planned and executed in wild, they used a number of mining-pools to collect payments from victims, but all the funds deposited to only one wallet.As of now $3 million has been mined.

2017 is the year of data breaches and ransomware, now attackers shifted their focus to crypto mining attacks by using victims resources. Starting from the year 2018 a number of Cryptomining Attacks launched to Mine Monero Cryptocurrency.

Last week Attackers hijacked 4275 websites to inject Coinhive Monero miner including the websites of government authorities(ico.org.uk), NHS Foundation (nhs.uk), and uscourts.gov.

More than 500 million computers are mining cryptoCurrency in their browsers without the user’s knowledge and also the chrome extension started mining cryptocurrency.

Also, the Oracle Weblogic vulnerability (CVE 2017-10271) abused to run crypto miners and hijacking their processing power to mine Monero coins makes the spike in CPU usage.

IoC

Domain and IP:

• 222[.]184[.]79[.]11
• 183[.]136[.]202[.]244
• btc[.]poolbt[.]com
• shell[.]poolbt[.]com
• xmr[.]btgirl[.]com[.]cn
• btc[.]btgirl[.]com[.]cn

File:

• 0bb4503cc52530ddadb102fa4010fb4d89af88aca846d4b16f601d0702134246
• 06f8eda46fd6bdc11b8ec4d18a0f0afbf3d47f82cea8363d342975896582a715
• f0430130a2f3549b1aeff0a9fb2246f68f585a7c1d312c7be385a1cf5f37e70d
• c87d294cb0384cb56f4829d58cdd3f53572d3f95c2133a9b1da5f5bc1710f22f
• f750d6da918a5f2f2c442a339821ffebcad4b61e4ca1684bac0e7df98416a794
• 3002551eebaf486d77a2b81d87db553ad8632bb132553e306395c5da589171fe
• 213a23219ff89c412f92aa1fdf7152178a81514014ee1cc4ffee97e725ee63a3
• ff8c97cd55523cbdceef80407269d35bbf78abcbf807426c12d9debe1ce498d9
• 2beaa23907c40cfcb705844f4f515ff81a788abe1aed2c8d23626d9d735968ae
• b22fa98c3ee99222c4e827a9745f206ccf7cd40530459a92f183e148b0df5ce9