Number of Domains Hosting Crypto-Miners Up 725% in Four Months

The number of websites hosting code that mines for crypto-coins using visitors’ CPU power went up a staggering 725% in a four-month period, Cyren reports.

The massive increase took place between September 2017 and January 2018 and was observed upon the monitoring of a sample of 500,000 sites, the security company says. The firm also noticed that some websites would run the crypto-mining scripts on more pages, knowingly or not.

The number of new mining sites registered a massive increase in October, plateaued in November, and then doubled in December and again in January, which suggests that the rate at which crypto-mining is spreading is accelerating.

This jump in activity, however, isn’t surprising, considering the meteoric rise in crypto-currency values over the past months, Cyren points out. Most of the scripts were designed to mine for Monero, a virtual coin that increased by almost 250% in value recently, attracting a lot of attention.

The spike in mining sites was also fueled by the launch of a Coinhive API that would allow websites to mine for Monero currency directly within the browser, Malwarebytes says. The API was launched in mid-September 2017 and the service has become highly popular fast.

Within weeks, the Coinhive API started being abused to launch crypto-mining attacks where the mining operation is automated, silent, and platform agnostic that doesn’t provide a site’s visitors with the possibility to opt out.

Coinhive has since introduced an API (AuthedMine) that explicitly requires user input when starting the mining operation. Between January 10 and February 6, however, the opt-in version of the API saw low usage at 40,000 per day, while the silent one was massively employed, at 3 million a day.

Malwarebytes says that crypto-mining has been their top detection overall starting September 2017, and that in-browser mining has been only one type of such malicious activity observed. To maximize profits, miscreants attempt to deliver their miners on as many devices as possible.

Some websites even found ways to make the mining operation persistent, by using of pop-unders that are placed right underneath the taskbar, thus being virtually invisible to the end user. Other miscreants booby-trap browser extensions to inject code in each web session and ensure continuous mining operations.

“Indeed, cryptocurrency mining is such a lucrative business that malware creators and distributors the world over are drawn to it like moths to a flame. The emergence of a multitude of new cryptocurrencies that can be mined by average computers has also contributed to the widespread abuse we are witnessing,” Malwarebytes says.

In a report this week, Kaspersky too warns that crypto-mining has become a top threat. The number of users attacked by malicious miners went up 1.5 times in 2017 compared to the previous year, to reach 2.7 million.

Victims who end up infected with crypto-miners have their computer’s power harvested for the benefit of the attackers, and the popularity of these malicious applications appears to be surpassing that of ransomware, the security company says.

One infection campaign was using a Potential Unwanted Application (PUA) module as the infection vector and a process-hollowing technique to inject the malware into a legitimate system process, and was also setting a system critical flag to the process, to prevent users from closing it. The malware was mining Electroneum, and earned operators over $7 million during the second half of 2017.

The same as ransomware, crypto-mining isn’t targeting only end-users, but organizations as well, given that their networks provide more mining power. Regardless of whether performed in-browser or through malware, the mining operations are expected to expand further, causing more harm in their path.

“Cryptomining is in its infancy and is expected to continue to grow exponentially. Companies need to address and protect against the threat now,” Cyren concludes.

Related: Crypto Mining Malware Infects Thousands of Websites

Related: Crypto-Mining Attack Targets Web Servers Globally

Copyright 2010 Respective Author at Infosec Island via Infosec Island Latest Articles "http://ift.tt/2FjqAln"