McAfee: Cybercriminals Improving Techniques as Cryptomining Explodes

Cyberattacks in the first three months of the year showed that bad actors are getting more technically sophisticated in their efforts by improving upon campaigns from 2017, according to researchers at McAfee.

In addition, the use of cryptocurrency mining malware skyrocketed in the first quarter, according to McAfee's "Lab Threats Report: June 2018," confirming reports from other cybersecurity firms that threat actors are increasingly turning away from ransomware -- last year's attack of choice -- for the profitable and much less noisy cryptomining. Also in the report, McAfee analysts said there was an average of five new threat samples every second, and that there was a number of complex nation-state campaigns fueled by the desire for money, political subversion or espionage.

(Source: Pixabay)

Cybercriminals learning from previous campaigns was a key point found in the first quarter. The McAfee researchers noted in the report that they "observed that bad actors are demonstrating a remarkable level of technical agility and innovation. Many of the attack schemes that surged toward the end of 2017 have been improved upon in creative and complex ways to avoid detection and mitigation."

Raj Samani, chief scientist at McAfee, pointed to a number of attacks between January and March that illustrated the point.

"In 2017, we saw a surge in the exploitation of benign technologies such as PowerShell," Samani told Security Now in an email. "In Q1 2018, we saw malicious actors approach such PowerShell exploits differently. For instance, cybercriminals are increasingly using .lnk shortcuts to surreptitiously deliver malicious PowerShell scripts. Such new .lnk malware schemes rose 59 percent in Q1. Gandcrab ransomware infected 50,000 systems in the first three weeks of the quarter, supplanting the Locky ransomware strains as the quarter's ransomware leader. Gandcrab uses new criminal methodologies, such as transacting ransom payments through the Dash cryptocurrency rather than through Bitcoin."

Another example was an attack during the runup to the South Korea Winter Olympic Games in which "we saw the use of steganography [a technique using hidden code] leveraged to infect/target 337 organizations," Samani wrote. "In fact, we saw this campaign adapt in flight; in other words, the malicious actors improved their tactics."

Threat actors also apparently learned from what they saw from the good guys, he said.

"They are getting better, although you can also point to the fact they follow the security community and their findings, as we saw with the use of the DDE issue reported in October and then used [by attackers] in the wild only a few weeks later," Samani wrote.

Cryptomining skyrockets
Crytpocurrency mining malware became popular among bad actors in the first quarter, according to McAfee's report, echoing findings from a growing number of cybersecurity companies, including Check Point and Symantec. McAfee itself talked about the growth in the number of cybercrimes involving cryptocurrency earlier this month in a reportdetailing how cybercriminals are using blockchain technology in their efforts. According to McAfee, the use of coin miner malware grew 629% in the first quarter. The total known samples of cryptojacking and other mining campaigns jumped from about 400,000 in the fourth quarter 2017 to more than 2.9 million during the first three months this year. (See Blockchain & Cryptocurrency Becoming Greater Security Concerns.)

Cybercriminals use malware to take over a victim's browser or steal the compute power on their system to secretly mine for cryptocurrencies, including Bitcoin, Monero and Dash. Cryptomining and similar attacks are easier to run, more efficient and less complicated than ransomware.

(Source: McAfee)

The rapid rise in the number of known samples "suggests that cybercriminals are warming to the prospect of monetizing infections of user systems without prompting victims to make payments, as is the case with popular ransomware schemes," Samani wrote "Compared with well-established cybercrime activities such as data theft and ransomware, cryptojacking is simpler, more straightforward and less risky. All criminals must do is infect millions of systems and start monetizing the attack by mining for cryptocurrencies on victims' systems. There are no middlemen, there are no fraud schemes, and there are no victims who need to be prompted to pay and who, potentially, may back up their systems in advance and refuse to pay."

Cryptocurrencies played a role in some nation-state campaigns, according to McAfee. Researchers pointed to the HaoBao phishing campaign perpetrated by the Lazarus Group -- an organization that cybersecurity experts believe is backed by the North Korean government and also is known as Hidden Cobra -- that targeted financial organizations and Bitcoin users around the world. The attacks used malicious email attachments that, when opened by users, embeds an implant that scans for Bitcoin activity as well as data gathering and cryptomining. (See Cybercrime Is North Korea's Biggest Threat.)

Other attacks believed to be connected to nation-states and highlighted by McAfee included Operation GhostSecret, which steals data from infected systems, and the most recent Bankshot variation of GhostSecret, which uses an embedded Adobe Flash exploit to implant malware. Hidden Cobra is believed to be behind those attacks. Gold Dragon, which was found by McAfee, targeted organizations involved in the Winter Olympics in February using a malicious Microsoft Word attachment that contained a hidden PowerShell fileless implant script. Like Olympic Destroyer, other malware aimed at the Olympics, countries like Russia and North Korea were suspected of being behind the attacks, but no groups were identified as the creators. (See Olympic Destroyer Returns With Attacks in Europe.)

Overall, the number of publicly disclosed incidents in the first quarter grew 41% year-to-year, to 313. Much of its was fueled by the rise in the cryptocurrency-related crimes, though Samani also pointed to a 10% increase in mobile malware.

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.