Skip to the main content.

1 min read

Surge in Bitcoin Mining Attacks Expected

Surge in Bitcoin Mining Attacks Expected
History Repeats Itself

During the surge of Bitcoin prices in 2017, nefarious actors hacked everything from web servers to browsers in an attempt to mine cryptocurrency. We even saw one of our client’s network routers be co-opted as coin miners!

We anticipate a similar surge of mining attacks in the coming weeks and months as cryptocurrency values soar once again, and new varieties flood the market. For example, Bitcoin’s value has skyrocketed to almost $40,000 in recent weeks, which will undoubtedly result in an increase in coin-mining hacking attempts.Surge in Bitcoin Mining Attacks Expected

Expected Targets

Ideal targets are unpatched software systems and IoT devices.  It’s not always possible to patch older software systems, and let’s face it; most organizations don’t know everything on their network. That’s where a combination of defenses can help.

Endpoint Protection

Advanced endpoint protection, such as CrowdStrike Falcon, is something that we use and strongly recommend. Having such Endpoint Detection & Response (EDR) capabilities on your hosts is becoming an absolute “must” in this day and age of memory-resident file-less and polymorphic malware. Unlike traditional anti-virus that relies on matching signatures of known malware, EDR monitors file activity, processes, and communications on a host to detect known and unknown threats and will automatically block suspicious activity in real-time.

Network Protection

Unfortunately, not every endpoint can have EDR installed, such as printers, IoT, and other network-connected devices, and that’s where network monitoring becomes a key companion capability. PacketWatch monitors and records all network traffic and can spot the telltale signs of coin-mining activity, even on those devices that cannot be protected by EDR.

Recent Incident Involving a Coin Miner

In December 2020, an enterprise-sized organization hired PacketWatch to help battle an incident that involved such a compromise. In this example, a PHP exploit was used to compromise a server and install a Bitcoin miner.

Using PacketWatch’s full packet capture to replay the coin-miner traffic, analysts were able to reverse engineer the scripts executed. As soon as the attackers compromised the Server, they also began running scripts to remove other competing coin miners that might be present in the environment, after which the script would harden the asset to prevent further intrusions. This level of visibility gave investigators a complete picture of the incident and left no questions about what had occurred and what the attackers were after. The client was able to clean the identified server and return to normal operation quickly.

Cyber Threat Intelligence Briefing - February 26, 2024

6 min read

Cyber Threat Intelligence Briefing - February 26, 2024

This week, we continue to cover the ConnectWise ScreenConnect vulnerabilities and United Healthcare Optum Breach and include a vulnerability roundup.

Read More
Two ConnectWise ScreenConnect Critical RCE Vulnerabilities

2 min read

Two ConnectWise ScreenConnect Critical RCE Vulnerabilities

ConnectWise recently released a security bulletin disclosing two new vulnerabilities in their ScreenConnect platform.

Read More
CVE-2024-21413: Microsoft Outlook Critical RCE

2 min read

CVE-2024-21413: Microsoft Outlook Critical RCE

As part of this month's Patch Tuesday, Microsoft released a fix for a critical vulnerability affecting multiple Outlook versions.

Read More