Crypto-Mining Hits 42% Of Organisations Worlwide

Cyber-criminals are aggressively targeting organisations using crypto-mining malware to develop illegal revenue streams, according to Check Point. Meanwhile, cloud infrastructures appear to be the growing target among threat actors.

Between January and June 2018, the number of organisations impacted by crypto-mining malware doubled to 42%, compared to 20.5% in the second half of 2017.

Crypto-mining malware enables cybercriminals to hijack the victim’s CPU or GPU power and existing resources to mine crypto-currency, using as much as 65% of the end-user’s CPU power. The top three most common malware variants seen in H1 2018 were all crypto-miners.

In a new trend, Check Point detected an increasing number of attacks targeting cloud infrastructures. With organisations moving more of their IT estates and data to cloud environments, criminals are turning to the cloud to exploit its vast computational power and multiply their profits.

“The first half of this year saw criminals continue the trend we observed at the end of 2017, and take full advantage of stealthy crypto-mining malware to maximise their revenues. We’ve also seen increasingly sophisticated attacks against cloud infrastructures and multi-platform environments emerging.

“These multi-vector, fast-moving, large-scale Gen V attacks are becoming more and more frequent, and organisations need to adopt a multi-layered cybersecurity strategy that prevents these attacks from taking hold of their networks and data,” said Maya Horowitz, Threat Intelligence Group Manager at Check Point.

Crypto-currency miners evolve

In 2018, crypto-miners have been upgraded with vastly improved capabilities, becoming more sophisticated and even destructive. Motivated by a clear interest to increase the percentage of computational resources leveraged and be even more profitable, crypto-miners today target anything that could be perceived as being in their way.

Crypto-miners have also highly evolved recently to exploit high profile vulnerabilities and to evade sandboxes and security products in order to expand their infection rates.

Hackers move to the cloud

So far this year, there have been a number of sophisticated techniques and tools exploited against cloud storage services.

Several cloud-based attacks, mainly those involving data exfiltration and information disclosure, derived from poor security practices, including credentials left available on public source code repositories or the use of weak passwords.

Crypto-miners are also, targeting cloud infrastructures to exploit its computational power and multiply profits for threat actors.

Multi-platform attacks on the rise

Up until the end of 2017, multi-platform malware was rare. However, the rise in the number of consumer connected devices and the growing market share of non-Windows operating systems has led to an increase in cross-platform malware. Campaign operators implement various techniques in order to take control over the campaigns’ different infected platforms.

Mobile malware spread via the supply chain

In the first half of this year, there has been several incidences where mobile malware that has not been downloaded from a malicious URL, but instead arrived already installed within the device. In addition, there was an increase in applications readily available on app stores that were actually malware under disguise, including Banking Trojans, Adware and sophisticated remote access Trojans (RATs).

Top Crypto-miners during H1 2018

1. Coinhive (30%) – A crypto-miner designed to perform online mining of the Monero crypto-currency without the user’s approval when a user visits a web page. Coinhive only emerged in September 2017 but has hit 12% of organizations worldwide hit by it.

2. Cryptoloot (23%) – A JavaScript Crypto-miner, designed to perform online mining of Monero crypto-currency when a user visits a web page without the user’s approval.

3. JSEcoin (17%) – Web-based Crypto miner designed to perform online mining of Monero crypto-currency when a user visits a web page without the user’s approval.

Top ransomware during H1 2018

1. Locky (40%) – Ransomware that spreads mainly via spam emails containing a downloader, disguised as a Word or Zip attachment, before installing malware that encrypts the user files.

2. WannaCry (35%) – Ransomware that was spread in a large scale attack in May 2017, utilizing a Windows SMB exploit called EternalBlue, in order to propagate within and between networks.

3. Globeimposter (8%) – Distributed by spam campaigns, malvertising and exploit kits. Upon encryption, the ransomware appends the .crypt extension to each encrypted file.

Top mobile malware during H1 2018

1. Triada (51%) – A Modular Backdoor for Android which grants super-user privileges to downloaded malware, as it helps it to get embedded into system processes. Triada has also been seen spoofing URLs loaded in the browser.

2. Lokibot (19%) – A mobile banking Trojan which targets Android smartphones and turns into a Ransomware, upon an attempt of the victim trying to remove its admin privileges.

3. Hidad (10%) – Android malware which repackages legitimate apps and then releases them to a third-party store. It is able to gain access to key security details built into the OS, allowing an attacker to obtain sensitive user data.

Top banking malware during H2 2017

1. Ramnit (29%) – A banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data.

2. Dorkbot (22%) – A banking Trojan which steals the victim’s credentials using web-injects, activated as the user tries to login to their banking website.

3. Zeus (14%) – A Trojan that targets Windows platforms and often uses them to steal banking information by man-in-the-browser keystroke logging and form grabbing.

HelpNetSecurity

You Might Also Read: 

Criminal Web-Injects Can Steal Cryptocurrency:

Crypto-Mining Is A Growing Epidemic:

 

« EU Cybersecurity Act Could Impact Cross-Border Data Flows
Quantum Computing Is Becoming Reality »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Marsh

Marsh

Marsh is a global leader in insurance broking and risk management and has been a leader in combatting cyber threats since their emergence.

IntSights

IntSights

IntSights is an intelligence driven security provider offering rapid, accurate cyberthreat intelligence and incident mitigation in real time

Guidewire

Guidewire

Guidewire Cyence™ Risk Analytics is a cloud-native economic cyber risk modeling solution built to help the insurance industry quantify cyber risk exposures.

Sphonic

Sphonic

Sphonic provides regulated institutions of any size a powerful compliance & risk platform to quickly and securely onboard new customers and manage ongoing AML and Fraud & Risk trends.

Keepnet Labs

Keepnet Labs

Keepnet Labs is a phishing defence platform that provides a holistic approach to people, processes and technology to reduce breaches and data loss and presents anti-phishing solutions.

Inavate Consulting

Inavate Consulting

Inavate Consulting are experts in defining and implementing information assurance solutions and governance frameworks. Our ISO27001 consultants are the most experienced in the industry.

Crypto Quantique

Crypto Quantique

Crypto Quantique's ground-breaking technology radically simplifies the process of generating a hardware root of trust in an IoT device.

Keysight Technologies

Keysight Technologies

Keysight is dedicated to providing tomorrow’s test technologies today, enabling our customers to connect and secure the world with their innovations.

Anvilogic

Anvilogic

Anvilogic provides a unifying experience for security professionals aimed at providing improved visibility, enrichment, and context across hundreds of alerting datasets and security tools.

Phronesis Security

Phronesis Security

Phronesis Security is committed to delivering world-class cyber security consulting with a tangible social and environmental impact.

Opal Security

Opal Security

Opal is an identity and access management platform that offers a consolidated view and control of your whole ecosystem from on-prem to cloud and SaaS.

Seers

Seers

Seers is the world’s leading privacy & consent management platform for companies worldwide. Trusted by over 50,000+ businesses.

CHERI Alliance

CHERI Alliance

CHERI Alliance is an industry initiative spearheading the global adoption of the Capability Hardware Enhanced RISC Instructions (CHERI) security technology across the computing industry.

Vulnify

Vulnify

At Vulnify, we’re revolutionizing the way businesses identify and manage security vulnerabilities.

Gray Swan

Gray Swan

Gray Swan is the safety and security provider for the AI era, founded by world leading experts in the AI safety and security space.

Seamfix

Seamfix

Seamfix helps businesses and their customers globally to seamlessly create, verify and access trusted digital identities and services.