Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Watch Dog: Exposing a Cryptojacking Campaign That’s Operated for Two Years

Summary: Unit 42 researchers documented a Monero cryptojacking operation called WatchDog that has run since Jan. 27, 2019, collecting at least 209 XMR worth roughly $32,056 USD, with an estimated 476 compromised Windows and NIX cloud instances mining at any one time. The operation uses three Go binaries - networkmanager for scanning and exploitation, phpguard to emulate the Linux watchdogd daemon, and phpupdate, a version of XMRig - plus bash or PowerShell scripts, and relies on 18 IP addresses and seven domains serving at least 125 URLs rather than a third-party hosting site.

Bottom line: WatchDog has stayed active for over two years without a takedown because it hosts its own payload, and its operators hold root and administrative access on the systems they compromised - access that could reach cloud IAM credentials, access IDs or keys.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related