Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Large Scale Monero Cryptocurrency Mining Operation using XMRig

Summary: Palo Alto Networks Unit 42 observed a Monero cryptocurrency mining operation using the open-source XMRig utility that had been active for over four months, with roughly 15 million victims connecting to the malicious bitly URLs used to distribute it. The attackers distributed over 250 unique Windows PE files, more than half from the 4sync cloud storage provider, using VBS files, URL shortening services, and XMRig proxy services to mask their wallets, and changed tactics roughly every month from BITSAdmin downloads to HTTP redirection, .NET droppers, and finally a Borland Delphi dropper.

Bottom line: Unit 42 estimates the true victim count could reach 30 million, since only about 100 of the 250 samples used bitly - meaning the telemetry that produced the 15 million figure captures less than half the campaign, and it ran largely unnoticed for over four months.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related