Posts

Latest Threat Intelligence Reveals Rising Tide of Cryptojacking

/0 Comments/in /by

Threat actors looking for a steadier (and stealthier) income stream pushed cryptojacking to record highs in 2022.

Late February was a wakeup call for anyone who still thought it was a good idea to illegally download software: Researchers identified a new version of cryptojacking malware hiding within cracked versions of Apple’s Final Cut Pro video editing app. This macOS-targeting malware was designed to turn the tables on pirates by hijacking their computers and using them to illegally mine Monero.

While this isn’t the first time XMRig, a perfectly legal cryptominer, has been identified in pirated Final Cut Pro software, this version is particularly stealthy. If a user happens to notice their machine’s performance is suffering and opens Activity Monitor to find the source of the trouble, XMRig shuts down to avoid detection, then relaunches once Activity Monitor is closed.

What is Cryptojacking?

Cryptojacking refers to the act of using a computer or other device to mine cryptocurrency without the knowledge or consent of the device’s owner. This process is often very resource-intensive, and can cause the device’s performance to suffer or result in higher electric bills for the target.

Cryptojacking Reached Record High in 2022

While companies such as Apple are working to bolster their defenses against cryptojacking campaigns, recent data suggests this may continue to be an uphill battle.

In the 2023 SonicWall Cyber Threat Report, SonicWall Capture Labs threat researchers reported a 43% year-over-year increase in cryptojacking attempts in 2022. This spike pushed attack volume past the 100-million mark for the first time ever and set a new record high of 139.3 million attacks by year’s end.

SonicWall also observed a shift in the locations being targeted. While North America experienced a 36% year-over-year increase, Asia and Europe both saw triple-digit increases, with the latter recording 6.5 times the number of attacks in 2022 as in 2021.

As noted in the report, some of this growth may be due to threat actors supplementing or shifting from ransomware to more low-profile revenue streams. At least one ransomware gang has publicly announced they were shutting down their ransomware operation in favor of cryptojacking. And based on the 21% year-over-year decrease in ransomware attacks observed by SonicWall in 2022, others have likely followed suit.

Attacks Becoming More Prevalent, Stealthy and Sophisticated

As cryptojacking becomes more widely adopted, it’s also expanding its territory, with threat actors continuing to broaden their scope beyond traditional Windows-based attacks. In addition to the recently discovered Final Cut Pro campaign, cryptominers have also been identified hitching a ride on other apps designed for Macs, such as Adobe Photoshop and Apple Logic Pro.

Linux servers and even internal Redis servers were also popular targets for cryptojacking campaigns in 2022. While we reported on the growth in Redis attacks in our 2023 Cyber Threat Report, in just the week since its launch, another cryptojacking campaign targeting Redis has been identified — this one leveraging the legitimate tool transfer[.]sh.

And as cryptojacking continues to pick up steam, cybercriminals are becoming increasingly innovative. For example, in January 2023, threat actors used automation to create 130,000 free trial accounts on cloud platform services, with the end goal of exploiting GitHub Actions workflows for illicit cryptomining.

With cryptojacking attacks on the rise and the cyber landscape continuing to evolve, staying up to date on the latest threat intelligence has never been more important.

“It is crucial for organizations to understand attackers’ tactics, techniques and procedures (TTPs), and commit to threat-informed cybersecurity strategies to defend and recover successfully from business-disrupting events,” said SonicWall Threat Detection and Response Strategist Immanuel Chavoya. “This includes stopping sophisticated ransomware attacks as well defending emerging threat vectors, including IoT and cryptojacking.”

What is Cryptojacking, and how does it affect your Cybersecurity?

/0 Comments/in /by

How do you know if cryptojacking is impacting your business? Learn how to spot infections and how to deploy solutions to protect your network and endpoints.

The good news for cryptocurrency is that the model is an established fixture in global finances. It’s highly portable, holds value, is tradable for products and services, and is gaining popularity among mainstream consumers.

It can also be a rewarding investment tool if you’re truly adventurous. Of course, fortunes are won and lost in a wink as many cryptocurrency issues (e.g., Bitcoin, Ethereum, Cardano) are highly volatile, with values sometimes soaring to astronomical highs and plummeting into white-knuckle lows within days or weeks. However, there are other less scary ways to make money from cryptocurrencies, and one of them is through “cryptomining.”

What is Cryptomining: An Explainer

Cryptomining is a process that validates cryptocurrency transactions in distributed public ledgers. Each transaction is linked to the previous and subsequent transaction, creating a chain of time-stamped records. This is essentially what a “blockchain” is all about.

One of the advantages of cryptomining is that just about anyone can participate without investing in the currency. For example, if you mine for Bitcoin, you receive Bitcoin as compensation for completing blocks of verified transactions added to the blockchain. It takes about 10 minutes to process a single block of currency.

All you need is a little knowledge about connecting to the cryptocurrency network, a reliable connection to the internet, one or two decent servers, and a steady power supply. The more server power you can enlist for your legitimate cryptomining operation, the more blocks you can process and the more money you make.

But there’s a twist to this process, and this is where the bad news comes in. Miners only earn cash when they complete the data process faster than others, and there are literally hundreds of miners trying to process the same block simultaneously. For that reason, miners are constantly looking for ways to scale up their hashrate (a metric for computational power to process blocks). The more hashes produced each second, potentially the more money you make.

Some people dodge the legitimate process entirely and turn to “cryptojacking.”

Why Cryptojacking is a rising threat.

It’s pretty simple: cryptojacking is cryptomining, but now the miner is using someone else’s computer without permission. Victims usually have no idea that their computers have been pressed into this kind of use, often through malware introduced by phishing or other hack.

In April 2018, SonicWall started tracking cryptojacking trends. Back then, the company recorded nearly 60 million cryptojacking attacks in one year. But as reported in the 2022 SonicWall Cyber Threat Report, cryptocurrency prices hit new highs in 2021, and with it, hacking incidents soared to 97 million, increasing nearly 62% since 2018.

Cryptojacking is on the rise

Unlike ransomware which relies on the visibility of phishing emails and messages, cryptojackers do their work invisibly in the background. The only sign your network or devices are affected is by monitoring a CPU performance graph or noticing that a device fan is running harder than usual.

Over the last two years, we’ve noticed that ransomware teams tend to switch to other activities like cryptojacking. One apparent reason they change is that the return on investment for a ransomware scheme and strain (that took months of development work) diminishes when it ends up on public feeds like VirusTotal.

Like anyone else running a profitable business, cybercriminals tend to be agile and flexible about their work. As a result, they’re actively searching for different ways to fulfill their financial targets. Cryptojacking offers agility thanks to the relative ease operators can deploy it with other criminal activity.

The allure of cryptomining.

With such low cost and practically zero risks, cybercriminals see many strong incentives to engage in cryptomining as a base business model. Much of the operation itself is automated through software. However, volatility in cryptocurrency plus rising energy costs is putting a lot of pressure on miners. In 2018, legitimate crypto miners could earn $100/day, but that profit has been halved nowadays, and staying “legit” is more complicated and harder to do.

Consequently, according to SonicWall’s threat report, illegal cryptojacking is again on the rise. The first quarter of 2021 saw 34.2 million hits in cryptojacking, making it the highest quarter since SonicWall began tracking this data point. But more worryingly, the worst month for cryptojacking in 2021 was, by far, December, with 13.6 million recorded. While December 2021 doesn’t eclipse the 15.5 million hits observed in March 2020, it makes for an easy second place, which was, by any comparison, a suboptimal starting point for 2022.

Am I infected by cryptojacking malware?

Cryptominers are interested in your processing power, and cryptojackers must trade stealth against profit. So how much of your CPU resources they take depends on their objectives.

Siphoning less power makes it harder for unsuspecting users to notice; stealing more increases their profits. Of course, there will be a performance impact in either case, but if the threshold is low enough, it could be challenging to distinguish the miner from legitimate software.

Enterprise administrators may look for unknown processes in their environment, and end-users of Windows software should start a Sysinternals Process Explorer to see what they are running. Linux and macOS users should investigate using System Monitor and Activity Monitor, respectively, for the same reason.

How to defend against malicious cryptojackers.

The first step in defending against cryptominers is to stop this type of malware at the gateway through firewalls or email security (perimeter security), which is one of the best ways to scrub out known file-based threats.

Since people like to reuse old code, catching cryptojackers is relatively simple. However, SonicWall predicts there will still be a surge in new cryptojacking variants and techniques as cryptojackers have time to develop more tools. In addition, cryptojacking could still become a favorite method for malicious actors because of its concealment; low and indirect damage to victims reduces chances of exposure and extends the useful lifespan of a successful attack.

If the malware strain is unknown (new or updated), it will bypass static filters in perimeter security. If a file is unknown, it will be routed to a sandbox to inspect the nature of the file.

The multi-engine SonicWall Capture Advanced Threat Protection (ATP) equipped with Real-Time (RTDMI)™ is proven to be highly effective in preventing evasive malware that may evade one engine but not the others.

If you have an endpoint not behind this typical setup (e.g., it’s roaming at the airport or hotel), you need to deploy an endpoint security product that includes behavioral detection.

Cryptominers can operate in the browser or be delivered through a fileless attack, so the legacy solutions you get free with a computer are blind to it.

Behavioral-based cybersecurity solutions like Capture Client ATP can detect malware that allows cryptomining and shut down the operation. Then, an administrator can quickly quarantine and delete the malware or, in the case of hacks that have done damage to system files, roll the system back to the last known good state before the malware was executed.

By combining a mixture of perimeter defenses and behavioral analysis, organizations can fight the newest malware forms no matter the trend or intent.