Millions of PCs Targeted by Cryptocurrency-Mining Malware

["Dave Farber" <farber () gmail com>]

Begin forwarded message:

> From: Dewayne Hendricks <dewayne () warpspeed com>
> Date: January 27, 2018 at 5:27:57 AM EST
> To: Multiple recipients of Dewayne-Net <dewayne-net () warpspeed com>
> Subject: [Dewayne-Net] Millions of PCs Targeted by Cryptocurrency-Mining Malware
> Reply-To: dewayne-net () warpspeed com
>
> [Note:  This item comes from friend Steve Goldstein.  DLH]
>
> Millions of PCs Targeted by Cryptocurrency-Mining Malware
> The hackers behind the malware appear to have been selling the hijacked computing power on the mining platform 
> NiceHash, according to Palo Alto Networks.
> By Michael Kan
> Jan 25 2018
> <https://www.pcmag.com/news/358766/millions-of-pcs-targeted-by-cryptocurrency-mining-malware>
>
> Malware is increasingly developing an appetite for cryptocurrency mining. One newly discovered strain has tried to 
> infect millions of Windows machines, all in an effort to siphon their computing power and possibly sell it for mining 
> purposes.
>
> The operation has been going on for over four months, and may have targeted around 15 million machines or more, 
> security firm Palo Alto Networks saidWednesday.
>
> To spread the malware, the hackers have been disguising the code as EXE files made to look like file-sharing 
> downloads with names such as "File4org," "RapidFiles" and "Dropmefiles." Those EXE files have then been circulated 
> online via shortened URL links through services like Bitly and possibly Adfly. It isn't clear where the hackers have 
> been posting the links, but they've generated at least 15 million clicks, according to Palo Alto Networks.
>
> Once the malware infects, it will secretly run an open-source utility called XMRig, which mines Monero, a digital 
> currency now worth about $310 per coin.
>
> "In this case the attackers set it to never use more than 20 percent of (CPU) resources," said Josh Grunzweig, a 
> malware researcher with Palo Alto Networks, in an email. As a result, most victims probably won't notice that the 
> mining is taking place.
>
> However, the hackers may be less interested in generating the Monero for themselves than helping others mine it. The 
> malware's code actually contains a reference to NiceHash, an online marketplace for people to buy and sell computing 
> power to mine cryptocurrencies.
>
> "In our research, we've seen that the attackers using it as the marketplace where they 'sell' the hash processing 
> power of the systems they've loaded XMRig on," Grunzweig said.
>
> Palo Alto Networks doesn't know how much Monero the hackers have mined with their malware, but it's been targeting 
> computers mainly in Southeast Asia, North Africa and South America.
>
> [snip]
>
> Dewayne-Net RSS Feed: http://dewaynenet.wordpress.com/feed/
> Twitter: https://twitter.com/wa8dzp



-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/18849915-ae8fa580
Modify Your Subscription: https://www.listbox.com/member/?member_id=18849915&id_secret=18849915-aa268125
Unsubscribe Now: 
https://www.listbox.com/unsubscribe/?member_id=18849915&id_secret=18849915-32545cb4&post_id=20180127073843:00838014-035F-11E8-A1D7-8468AEBC72F6
Powered by Listbox: http://www.listbox.com