VP of research and intelligence at BlackBerry.
joys Lemos says that a crypto mining software is not necessarily malicious but rather opportunistic utilizing compute resources for monetary gain, "although you often find it paired with malicious software,” and it’s also a fact not well-enough observed by some organizations when it comes to protecting their networks.
" Any Cryptojacking malware can be dangerous "
Lemos further elaborated on crypto mining apps getting sophisticated nowadays, saying that crypto miners don’t need to be sophisticated and can be deliver in various ways: "from JavaScript running on a website as a watering hole attack or embedded in a spear-phishing email to supply chain attacks with miners embedded in docker hub images and malicious browser extensions.” He went on to add that: “Distribution is the primary goal and with detection does not carry a meaningful risk, TAs can spread their miners far and wide."
Recent cryptojacking cases, like Lucifer, show a pattern — the common usage of XMRig crypto-miner app in the attacks.
BlackBerry executive explained why " Monero (XMR) is often used in the attacks, rather than other currencies: “Monero is pitched as more lucrative to the average user due to the nature of the mining algorithm.
Anytime you have uneducated users looking for a quick buck, you will have more opportunities for exploitation. The old adage still holds true: the best way to get rich in a gold rush is to sell shovels. In this case, the shovels also contain malware.”
Pandemic driving cryptojacking attacks? Lemos believes that the fact of hackers using full malware suites with capabilities that leverage numerous vulnerabilities to establish persistence shows a growing trend in such kind of cryptojacking attacks, and Lucifer is “a continuation or evolution of that trend.”
As the COVID-19 pandemic is still active in several countries, Lamos claims that as long as cryptocurrencies are being considered as a “valuable alternative investment,” the rising trend of the cryptojacking attacks “is here to stay,” as it’s not about blaming the coronavirus-related jump specifically.