Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Attackers Conducting Cryptojacking Operation Against U.S. Education Organizations

Summary: Unit 42 researchers observed three incidents, on Feb. 16, March 10 and March 15, 2021, in which a webshell backdoor on compromised hosts at U.S. education organizations was commanded to download an UPX-packed cpuminer and mine cryptocurrency. The requests shared the same attack pattern and payload but differed in user agent strings and the addition of a pass value, and the first incident failed because the mining algorithm was misspelled as cpupoer instead of cpupower.

Why it matters: The attacker's stated goal was to receive cryptocurrency at two specific wallet addresses, and the backdoor's command traffic was hidden in ordinary-looking HTTP requests to a domain owned by an education organization - the same sector, hit three times in a month, with the initial access vector still unknown.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related