Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Smoking Out the Rarog Cryptocurrency Mining Trojan

Summary: Unit 42 researchers documented the Rarog coin mining Trojan, sold on Russian-speaking underground forums since June 2017 for 6,000 Rubles (about US $104), with roughly 2,500 unique samples observed connecting to 161 command and control servers and over 166,000 confirmed infections worldwide. The malware mines Monero, persists via Run registry keys, scheduled tasks and startup folder shortcuts, can infect USB devices and load additional DLLs, and also carries botnet capabilities including downloading other malware and launching DDoS attacks.

Why it matters: Despite 166,000 infections concentrated in the Philippines, Russia and Indonesia, the most profitable attacker observed earned roughly 0.58 Monero and 54 ByteCoin - about $123.68, barely above the $104 purchase price - meaning most buyers lost money while their victims' machines were still conscripted into a botnet.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related