Thursday, March 28, 2024

Biggest Crypto-Mining Campaign Ever – Hackers Mine $3 Million Worth of Monero Crypto-currency

Security researchers from Checkpoint discovered a largest Monero mining activity that uses XMRig miner on various versions of Windows machines.

The hacker group earned more than $3 million worth Monero coins, and now to speed up their mining process they are targeting powerful Jenkins CI server.

Past few year Crypto currency mining is a very easy method for cyber criminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

How Attackers Inject Monero Mining Payloads

To install Monero mining payloads attackers leverage the known vulnerability CVE-2017-1000353 in the Jenkins Java deserialization implementation which accepts any serialized objects.

Attackers exploit the vulnerability by sending multiple successive session requests to CLI Interface.

Researchers said “After the first request, the second request that contains crafted packets will be sent immediately. The First request is to identify the client capabilities and the second one consist of the Monero miner payload”.
Monero mining

The malicious code initiates the hidden PowerShell to run the scripts in the background and downloads final Monero miner payload minerxmr.exe to windows servers. And later on, start command will be executed to start the mining process.

START C:\\Windows\\minerxmr.exe

Researchers said “The operation uses a hybridization of a Remote Access Trojan (RAT) and XMRig miner over the past months to target victims around the globe. The miner is capable of running on many platforms and Windows versions.”

The mining operation is well planned and executed in wild, they used a number of mining-pools to collect payments from victims, but all the funds deposited to only one wallet.As of now $3 million has been mined.

2017 is the year of data breaches and ransomware, now attackers shifted their focus to crypto mining attacks by using victims resources. Starting from the year 2018 a number of Cryptomining Attacks launched to Mine Monero Cryptocurrency.

Last week Attackers hijacked 4275 websites to inject Coinhive Monero miner including the websites of government authorities(ico.org.uk), NHS Foundation (nhs.uk), and uscourts.gov.

More than 500 million computers are mining cryptoCurrency in their browsers without the user’s knowledge and also the chrome extension started mining cryptocurrency.

Also, the Oracle Weblogic vulnerability (CVE 2017-10271) abused to run crypto miners and hijacking their processing power to mine Monero coins makes the spike in CPU usage.

IoC

Domain and IP:

  • 222[.]184[.]79[.]11
  • 183[.]136[.]202[.]244
  • btc[.]poolbt[.]com
  • shell[.]poolbt[.]com
  • xmr[.]btgirl[.]com[.]cn
  • btc[.]btgirl[.]com[.]cn

File:

  • 0bb4503cc52530ddadb102fa4010fb4d89af88aca846d4b16f601d0702134246
  • 06f8eda46fd6bdc11b8ec4d18a0f0afbf3d47f82cea8363d342975896582a715
  • f0430130a2f3549b1aeff0a9fb2246f68f585a7c1d312c7be385a1cf5f37e70d
  • c87d294cb0384cb56f4829d58cdd3f53572d3f95c2133a9b1da5f5bc1710f22f
  • f750d6da918a5f2f2c442a339821ffebcad4b61e4ca1684bac0e7df98416a794
  • 3002551eebaf486d77a2b81d87db553ad8632bb132553e306395c5da589171fe
  • 213a23219ff89c412f92aa1fdf7152178a81514014ee1cc4ffee97e725ee63a3
  • ff8c97cd55523cbdceef80407269d35bbf78abcbf807426c12d9debe1ce498d9
  • 2beaa23907c40cfcb705844f4f515ff81a788abe1aed2c8d23626d9d735968ae
  • b22fa98c3ee99222c4e827a9745f206ccf7cd40530459a92f183e148b0df5ce9
Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles