Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

6/28/2018
09:35 AM
Jeffrey Burt
Jeffrey Burt
Jeffrey Burt
50%
50%

McAfee: Cybercriminals Improving Techniques as Cryptomining Explodes

Cybercrime campaigns during the quarter showed that bad actors are improving upon the threats from last year, according to McAfee. Meanwhile, cryptomining schemes continue to skyrocket.

Cyberattacks in the first three months of the year showed that bad actors are getting more technically sophisticated in their efforts by improving upon campaigns from 2017, according to researchers at McAfee.

In addition, the use of cryptocurrency mining malware skyrocketed in the first quarter, according to McAfee's "Lab Threats Report: June 2018," confirming reports from other cybersecurity firms that threat actors are increasingly turning away from ransomware -- last year's attack of choice -- for the profitable and much less noisy cryptomining. Also in the report, McAfee analysts said there was an average of five new threat samples every second, and that there was a number of complex nation-state campaigns fueled by the desire for money, political subversion or espionage.

(Source: Pixabay)
(Source: Pixabay)

Cybercriminals learning from previous campaigns was a key point found in the first quarter. The McAfee researchers noted in the report that they "observed that bad actors are demonstrating a remarkable level of technical agility and innovation. Many of the attack schemes that surged toward the end of 2017 have been improved upon in creative and complex ways to avoid detection and mitigation."

Raj Samani, chief scientist at McAfee, pointed to a number of attacks between January and March that illustrated the point.

"In 2017, we saw a surge in the exploitation of benign technologies such as PowerShell," Samani told Security Now in an email. "In Q1 2018, we saw malicious actors approach such PowerShell exploits differently. For instance, cybercriminals are increasingly using .lnk shortcuts to surreptitiously deliver malicious PowerShell scripts. Such new .lnk malware schemes rose 59 percent in Q1. Gandcrab ransomware infected 50,000 systems in the first three weeks of the quarter, supplanting the Locky ransomware strains as the quarter's ransomware leader. Gandcrab uses new criminal methodologies, such as transacting ransom payments through the Dash cryptocurrency rather than through Bitcoin."

Another example was an attack during the runup to the South Korea Winter Olympic Games in which "we saw the use of steganography [a technique using hidden code] leveraged to infect/target 337 organizations," Samani wrote. "In fact, we saw this campaign adapt in flight; in other words, the malicious actors improved their tactics."

Threat actors also apparently learned from what they saw from the good guys, he said.

"They are getting better, although you can also point to the fact they follow the security community and their findings, as we saw with the use of the DDE issue reported in October and then used [by attackers] in the wild only a few weeks later," Samani wrote.

Cryptomining skyrockets
Crytpocurrency mining malware became popular among bad actors in the first quarter, according to McAfee's report, echoing findings from a growing number of cybersecurity companies, including Check Point and Symantec. McAfee itself talked about the growth in the number of cybercrimes involving cryptocurrency earlier this month in a reportdetailing how cybercriminals are using blockchain technology in their efforts. According to McAfee, the use of coin miner malware grew 629% in the first quarter. The total known samples of cryptojacking and other mining campaigns jumped from about 400,000 in the fourth quarter 2017 to more than 2.9 million during the first three months this year. (See Blockchain & Cryptocurrency Becoming Greater Security Concerns.)

Cybercriminals use malware to take over a victim's browser or steal the compute power on their system to secretly mine for cryptocurrencies, including Bitcoin, Monero and Dash. Cryptomining and similar attacks are easier to run, more efficient and less complicated than ransomware.

(Source: McAfee)
(Source: McAfee)

The rapid rise in the number of known samples "suggests that cybercriminals are warming to the prospect of monetizing infections of user systems without prompting victims to make payments, as is the case with popular ransomware schemes," Samani wrote "Compared with well-established cybercrime activities such as data theft and ransomware, cryptojacking is simpler, more straightforward and less risky. All criminals must do is infect millions of systems and start monetizing the attack by mining for cryptocurrencies on victims' systems. There are no middlemen, there are no fraud schemes, and there are no victims who need to be prompted to pay and who, potentially, may back up their systems in advance and refuse to pay."

Cryptocurrencies played a role in some nation-state campaigns, according to McAfee. Researchers pointed to the HaoBao phishing campaign perpetrated by the Lazarus Group -- an organization that cybersecurity experts believe is backed by the North Korean government and also is known as Hidden Cobra -- that targeted financial organizations and Bitcoin users around the world. The attacks used malicious email attachments that, when opened by users, embeds an implant that scans for Bitcoin activity as well as data gathering and cryptomining. (See Cybercrime Is North Korea's Biggest Threat.)

Other attacks believed to be connected to nation-states and highlighted by McAfee included Operation GhostSecret, which steals data from infected systems, and the most recent Bankshot variation of GhostSecret, which uses an embedded Adobe Flash exploit to implant malware. Hidden Cobra is believed to be behind those attacks. Gold Dragon, which was found by McAfee, targeted organizations involved in the Winter Olympics in February using a malicious Microsoft Word attachment that contained a hidden PowerShell fileless implant script. Like Olympic Destroyer, other malware aimed at the Olympics, countries like Russia and North Korea were suspected of being behind the attacks, but no groups were identified as the creators. (See Olympic Destroyer Returns With Attacks in Europe.)

Overall, the number of publicly disclosed incidents in the first quarter grew 41% year-to-year, to 313. Much of its was fueled by the rise in the cryptocurrency-related crimes, though Samani also pointed to a 10% increase in mobile malware.

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Sure you have fire, but he has an i7!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27314
PUBLISHED: 2021-03-05
SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.
CVE-2019-18630
PUBLISHED: 2021-03-04
On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, portions of the drive containing executable code were not encrypted thus leaving it open to potential cryptographic information disclosure.
CVE-2021-25344
PUBLISHED: 2021-03-04
Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission.
CVE-2021-25345
PUBLISHED: 2021-03-04
Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format.
CVE-2021-25346
PUBLISHED: 2021-03-04
A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code execution.