Crypto-Mining Hits 42% Of Organisations Worlwide

Cyber-criminals are aggressively targeting organisations using crypto-mining malware to develop illegal revenue streams, according to Check Point. Meanwhile, cloud infrastructures appear to be the growing target among threat actors.

Between January and June 2018, the number of organisations impacted by crypto-mining malware doubled to 42%, compared to 20.5% in the second half of 2017.

Crypto-mining malware enables cybercriminals to hijack the victim’s CPU or GPU power and existing resources to mine crypto-currency, using as much as 65% of the end-user’s CPU power. The top three most common malware variants seen in H1 2018 were all crypto-miners.

In a new trend, Check Point detected an increasing number of attacks targeting cloud infrastructures. With organisations moving more of their IT estates and data to cloud environments, criminals are turning to the cloud to exploit its vast computational power and multiply their profits.

“The first half of this year saw criminals continue the trend we observed at the end of 2017, and take full advantage of stealthy crypto-mining malware to maximise their revenues. We’ve also seen increasingly sophisticated attacks against cloud infrastructures and multi-platform environments emerging.

“These multi-vector, fast-moving, large-scale Gen V attacks are becoming more and more frequent, and organisations need to adopt a multi-layered cybersecurity strategy that prevents these attacks from taking hold of their networks and data,” said Maya Horowitz, Threat Intelligence Group Manager at Check Point.

Crypto-currency miners evolve

In 2018, crypto-miners have been upgraded with vastly improved capabilities, becoming more sophisticated and even destructive. Motivated by a clear interest to increase the percentage of computational resources leveraged and be even more profitable, crypto-miners today target anything that could be perceived as being in their way.

Crypto-miners have also highly evolved recently to exploit high profile vulnerabilities and to evade sandboxes and security products in order to expand their infection rates.

Hackers move to the cloud

So far this year, there have been a number of sophisticated techniques and tools exploited against cloud storage services.

Several cloud-based attacks, mainly those involving data exfiltration and information disclosure, derived from poor security practices, including credentials left available on public source code repositories or the use of weak passwords.

Crypto-miners are also, targeting cloud infrastructures to exploit its computational power and multiply profits for threat actors.

Multi-platform attacks on the rise

Up until the end of 2017, multi-platform malware was rare. However, the rise in the number of consumer connected devices and the growing market share of non-Windows operating systems has led to an increase in cross-platform malware. Campaign operators implement various techniques in order to take control over the campaigns’ different infected platforms.

Mobile malware spread via the supply chain

In the first half of this year, there has been several incidences where mobile malware that has not been downloaded from a malicious URL, but instead arrived already installed within the device. In addition, there was an increase in applications readily available on app stores that were actually malware under disguise, including Banking Trojans, Adware and sophisticated remote access Trojans (RATs).

Top Crypto-miners during H1 2018

1. Coinhive (30%) – A crypto-miner designed to perform online mining of the Monero crypto-currency without the user’s approval when a user visits a web page. Coinhive only emerged in September 2017 but has hit 12% of organizations worldwide hit by it.

2. Cryptoloot (23%) – A JavaScript Crypto-miner, designed to perform online mining of Monero crypto-currency when a user visits a web page without the user’s approval.

3. JSEcoin (17%) – Web-based Crypto miner designed to perform online mining of Monero crypto-currency when a user visits a web page without the user’s approval.

Top ransomware during H1 2018

1. Locky (40%) – Ransomware that spreads mainly via spam emails containing a downloader, disguised as a Word or Zip attachment, before installing malware that encrypts the user files.

2. WannaCry (35%) – Ransomware that was spread in a large scale attack in May 2017, utilizing a Windows SMB exploit called EternalBlue, in order to propagate within and between networks.

3. Globeimposter (8%) – Distributed by spam campaigns, malvertising and exploit kits. Upon encryption, the ransomware appends the .crypt extension to each encrypted file.

Top mobile malware during H1 2018

1. Triada (51%) – A Modular Backdoor for Android which grants super-user privileges to downloaded malware, as it helps it to get embedded into system processes. Triada has also been seen spoofing URLs loaded in the browser.

2. Lokibot (19%) – A mobile banking Trojan which targets Android smartphones and turns into a Ransomware, upon an attempt of the victim trying to remove its admin privileges.

3. Hidad (10%) – Android malware which repackages legitimate apps and then releases them to a third-party store. It is able to gain access to key security details built into the OS, allowing an attacker to obtain sensitive user data.

Top banking malware during H2 2017

1. Ramnit (29%) – A banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data.

2. Dorkbot (22%) – A banking Trojan which steals the victim’s credentials using web-injects, activated as the user tries to login to their banking website.

3. Zeus (14%) – A Trojan that targets Windows platforms and often uses them to steal banking information by man-in-the-browser keystroke logging and form grabbing.

HelpNetSecurity

You Might Also Read: 

Criminal Web-Injects Can Steal Cryptocurrency:

Crypto-Mining Is A Growing Epidemic:

 

« EU Cybersecurity Act Could Impact Cross-Border Data Flows
Quantum Computing Is Becoming Reality »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

NCC Group

NCC Group

NCC Group is a global cyber and software resilience business operating across multiple sectors, geographies and technologies.

Secure360

Secure360

Secure360 focuses on the following key areas: governance, risk and compliance, information security, physical security, business continuity management, and professional development.

NordForsk

NordForsk

NordForsk facilitates and provides funding for Nordic research cooperation and research infrastructure. Project areas include digitalisation and digital security.

Identify Security Software

Identify Security Software

Our mission is to bring in a new age of autonomous human authentication in the security and identity space.

SCIPP International

SCIPP International

SCIPP’s courses are based on internationally recognized best business practices for security awareness, for both technical and non-technical staff and to comply with regulatory mandates.

CRYPTTECH

CRYPTTECH

CRYPTTECH specializes in Information Security and Intelligence, Risk Evaluation and Vulnerability Recognition against Cyber-Attacks and APTs.

United Biometrics

United Biometrics

United Biometrics is an anonymous and real-time authentication platform designed to stop the fraud for mobile payments, e-Commerce and applications.

Raonsecure

Raonsecure

Raonsecure is one of Korea’s leading ICT security software companies – providing a variety of PC and mobile security solutions to financial institutions, government, and enterprise.

Outseer

Outseer

Outseer is a leading technology company in the fight against payments fraud. Outseer reliably determines authentic customers from fraudulent behavior.

Mosaic Insurance

Mosaic Insurance

Mosaic is a next-generation global specialty insurer distinguished by an exceptional team, agile technology, and a structure that combines Lloyd’s of London strength with a global distribution network

Institute for Pervasive Cybersecurity - Boise State University

Institute for Pervasive Cybersecurity - Boise State University

Boise State University’s Institute for Pervasive Cybersecurity is a leader of innovative cybersecurity research and advancement in Idaho and the region.

Aembit

Aembit

Aembit is the Identity Platform that lets DevOps and Security manage, enforce, and audit access between federated workloads

Cybastion

Cybastion

Cybastion develops robust world-class cybersecurity solutions tailored to suit the needs of different businesses, governments and public sector entities.

KnoTra Global

KnoTra Global

KnoTra Global is a next-generation Managed Service provider with a portfolio of services including Cybersecurity Solutions, Network Management, IT Leadership, and Day-to-Day Helpdesk and IT services.

Professional Labs

Professional Labs

Professional Labs specialize in simplifying complex problems for our customers with Cloud Services, Managed Services and Cyber Security.

TrustMe

TrustMe

TrustMe’s integrated platform for business trust and resilience keeps organizations safe, secure, and trustworthy.