Windows, Linux Devices Hijacked In Two-Year Cryptojacking Campaign

silversurfer

Level 85
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Malware Hunter
Well-known
Aug 17, 2014
10,057
Cryptocurrency-mining malware, called WatchDog, has been running under the radar for more than two years – in what researchers call one of the largest and longest-lasting Monero cryptojacking attacks to date.

The attack is still in operation as of this writing – and due to the size and scope of the infrastructure, it will be difficult to fully contain, researchers told Threatpost. Thus far, attackers have hijacked at least 476 Windows and Linux devices, in order to abuse their system resources for mining Monero cryptocurrency.

Right now, the attackers behind this campaign are sticking to cryptojacking – but researchers warn that it is “highly likely” they could find identity and access management (IAM) data on previously-compromised cloud systems, due to the root and administrative access that’s acquired during the malware implantation. This could open the door for future – and more dangerous – attacks.

“It is clear that the WatchDog operators are skilled coders and have enjoyed a relative lack of attention regarding their mining operations,” said researchers with Palo Alto Networks on Wednesday. “While there is currently no indication of additional cloud compromising activity at present (i.e. the capturing of cloud platform identity and access management credentials, access ID or keys), there could be potential for further cloud account compromise.”
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
i don't think many people have Go installed - at least on Windows
Anyway, it can be installed silently by initial malware without a problem. Such an installation will not be recognized by the AV as malicious. A similar technique was already seen in the wild with nasty Python malware.:(
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top