Thursday, December 7, 2023

Hackers Сovertly Mining Cryptocurrency on Government Websites in India

Almost all government sites in India have been infected by malware that uses the power of visitors’ computers to extract cryptographic material using the CoinHive script.

India’s official government sites have become the primary target for cryptocurrency, The Economic Times reports. The attack on the computers leads to malware that uses the processing power to extract the cryptocurrency in favor of the attacker, without the knowledge of the computer owner.

A new study by cybersecurity analysts shows that government sites with very high levels of trust have been subjected to web-based injections (code injection), including one of the latter that infected the Andhra Pradesh administration page.

The experts identified the infected sites as one of the most visited resources in the country. The government of India confirmed that the attack actually took place, but so far the problem has not been resolved. The volumes of tokens on government sites have also not been disclosed yet.

“Hackers are targeting government sites because these pages have extremely high traffic, which facilitates mining, plus visitors trust the content of the website. It wouldn’t occur to anyone that a provincial or state administration website would contain malicious code. Previously, we watched such sites being cracked; now web injections are in fashion because that’s how an attacker can make a lot of money,” the research authors say.

Along with government domains, CoinHive have infected 119 more Indian sites. The researchers warn that, in addition to these government sites, of particular interest to hackers are sites of illegal video streaming, because while the user watches a movie or series script has the ability to fully load the processor machine. This original idea only confirms that outsourcing in India is not a bad idea.

Hidden mining brings a noticeable profit to cybercriminals. Only a month ago, researchers from RWTH Aachen University, Germany, calculated that the script CoinHive, which infected sites around the world, mines more than 250 thousand USD per month in Monero.

This is mainly done through the process of the hidden use of computing resources on people’s computers without their consent.

Since browser extensions do not require user rights, the software can simply operate in a hidden mode. This results in attackers adding mining functionality to their websites as a means of generating additional revenue.

Although CoinHive is not the only mining extension for a browser, it has been found to have the highest usage share – over 75% of browser usage.

CoinHive does a lot of damage to the industry. The fact that CoinHive is widely used among website owners has a bad impact on the cryptographic industry as a whole. CoinHive script itself is not officially a virus – the authors of this software suggest using extensions as a way to monetize those resources where there is no advertising.


Latest articles

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...

Hackers Deliver AsyncRAT Through Weaponized WSF Script Files

The AsyncRAT malware, which was previously distributed through files with the .chm extension, is now being...

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles