When Cryptocurrency Falls, What Happens to Cryptominers?

The fall of cryptocurrencys value doesnt signify an end to cryptomining, but attackers may be more particular about when they use it.

Cryptocurrency has begun to lose its value, prompting financially motivated cybercriminals to rethink their attack strategies as the payoff for cryptojacking declines.
Cybercriminals go where the money is, and in 2018 the money was in digital currencies. Malicious cryptomining, in which attackers inject malware into target systems and hijack their power to illegally mine cryptocurrency, became the go-to attack vector. Businesses, with their plethora of vulnerable machines, became
hot targets
for cybercriminals looking for steady, easy money.
Ransomware attacks exchange victims data for a lump sum of cash and theres no guarantee attackers will receive a payout. Cryptomining generates revenue, and lots of it, on a regular basis. While ransomware rose this year, cryptomining skyrocketed 629% in Q1 2018 alone, McAfee Labs
reported
. In Q2, cryptomining samples grew 86% to reach more than 2.5 million new ones.
What adversaries realize is theres a reliable, dependable way to get consistent money and they really flock toward it because of that, says Cisco Talos threat researcher Nick Basini.
The mass adoption of cryptomining comes with risks. Chief among them: cryptocurrencys value. In a new report from Cisco Talos, he explains how an adversary could make $0.25 per day on a basic home computer. Now, a little more than $.04 per day can be made on the same device. Basini notes that around 75% to 85% of cryptocurrencys value has been lost throughout 2018.
What weve really seen over the last year, and more recently over the last couple of months, is there has been a marked decrease in all cryptocurrencies, he says. Monero, the preferred digital currency among cybercriminals, has taken the hardest hit. Cybercriminals arent abandoning cryptojacking any time soon, but they are changing their strategies, he adds.
Making Choices with Modular Malware
In a report on their research, Talos analysts report spam levels are a strong indicator of how an attack is affecting the threat landscape. Much of the spam they see is generated by botnets, and those botnets are intended to generate revenue. In early 2018, Talos saw near constant campaigns delivering malicious cryptominers or using a downloader.
As the year went on and cryptocurrency prices dropped, adversaries began exploring different tactics and sending different payloads. The trend, Basini says, is moving toward modular malware that lets adversaries deliver varied threats depending on the target machine. Cryptojacking is far from the only way to monetize a compromised system, he points out.
Its a natural evolution, says Basini of the shift. But also, adversaries have options, and in the past they didnt really have that.
Modular malware lets cybercriminals learn more about a device so they can decide how to proceed. When it lands on a machine, it collects data, like what type of hardware it is, where its located, whether its attached to a domain, and who owns the domain. This data could dictate the payload. A gaming machine with a lot of horsepower would be handy for cryptomining; an executives laptop would grant access more powerful than mining would provide.
Of course, its hard to predict the future of something as volatile as cryptocurrency. If the value of cryptocurrency goes back up, everything goes out the window, Basini notes. For now, though, attackers are getting smarter about maximizing ROI for each of their targets.
These types of modular malware frameworks that allow adversaries to deliver varied payloads are going to continue to rise in popularity, as the final payload can depend on a lot of external factors,
Basini explains
in the report.
Cryptomining Attackers: Where to Next?
In a separate post, Talos researchers
dive into
the activity of three separate attack groups focused on cryptomining: Rocke, 8220 Mining Group, and Tor2Mine. Early investigations mistakenly interpreted the three as being a single actor; further analysis showed three groups with similar TTPs which have amassed hundreds of thousands of US dollars combined.
Shared TTPs include malicious shell scripts disguised as JPEG files with the name logo*.jpg that download and execute miners. They also scan for, and attempt to exploit, recently published bugs in servers like Apache Struts 2, Oracle WebLogic, and Drupal. They use malicious scripts and malware hosted on Pastebin sites, Git repositories, and .tk top-level domains.
Researchers have been watching these groups and their cryptomining activity since early 2018, Basini says, and they are all affected by the decline in cryptocurrencys value. For example, Rocke started to develop destructive malware disguised as ransomware, an effort to diversify payloads in response to the drop in value.

Last News
▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps