WOW - Malware that can automatically decide to download a cryptominer or to launch a Ransomware or to become a worm.

The decision to download the cryptor or the miner depends on the presence of the folder %AppData%\Bitcoin. If the folder exists, the downloader decides to download the cryptor. If the folder doesn’t exist and the machine has more than two logical processors, the miner will be downloaded. If there’s no folder and just one logical processor, the downloader jumps to its worm component.

Researchers identified a new variant of the remote execution downloader that queries the victim's system on a number of factors, from the existence of Bitcoin storage to the presence of certain virtual machine managers, before downloading either an encryption payload or one that begins mining Monero coins


Full details here:
https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/

Protect against "Roaming Mantis" Malware - Disable your router's remote administration feature and hardcode a trusted DNS server into the operating system network settings (NOT rocket science, plain common sense)

Roaming Mantis -  Steals sensitive information from Android and iOS devices and  Roaming Mantis injects a browser-based cryptocurrency mining script

Since the hacking campaign is using attacker-controlled DNS servers to spoof legitimate domains and redirect users to malicious download files, you are advised to make sure the sites you are visiting has HTTPS enabled.


To check if your Wi-Fi router is already compromised, review your DNS settings and check the DNS server address. If it does not match the one issued by your provider, change it back to the right one. Also change all your account passwords immediately.



https://thehackernews.com/2018/05/routers-dns-hijacking.html

5 year old vulnerability exploited by cryptominer - Common sense approach is to patch all Internet facing systems and isolate/semi-isolate internal systems if they can't be patched.

A security vulnerability that is nearly 5 years old has now become the favorite tool of hackers as they are using it to infect Linux servers with crypto mining malware. The vulnerability that is being exploited in this cryptojacking campaign is classified as CVE-2013-2618. The miner is an altered XMRig tool, which is a legitimate, open-source Monero miner.

It is basically a flaw that was identified years ago (in April 2013), in Cacti’s Network Weathermap plug-in.

The key targets of this campaign are publicly accessible x86-64 Linux webservers, while the scope of the attack is not limited to any single destination since webservers across the globe are being targeted. Japan, China, Taiwan and the US are identified as the top targets.

https://www.hackread.com/vulnerability-used-for-monero-mining-on-linux-servers/

"Coffeeminer" - Not a new Starbucks menu item. - open-source toolkit that will inject rogue cryptomining code into Wi-Fi traffic automatically. Before you think it is OK, you should know the difference between "Cryptmining" and "Cryptojacking"

Cryptomining – performing the zillions of cryptographic calculations you need to earn hot-topic cryptocurrencies such as Bitcoin, Monero or Ethereum – is a massive global industry these days

Cryptojacking - Get familiar with this term as it might start showing up in  news
Break into someone’s network and install cryptomining software onto their computers so you can steal their electricity and CPU power – laptops are good, servers are better, and supercomputers are the best of all.

There’s even a malware family known as WannaMine – a portmanteau name that borrows the “Wanna” from the exploit-based spreading technique of the WannaCry ransomware worm, and “Mine” from, well, from the process of cryptomining.


cryptojacking is a clear and present danger:

1. There’s a reputational cost. What else did the crooks implant during the breach? 
2. There’s a regulatory cost. What happens after you report the breach, which you’ll need to do? 
3. There’s an opportunity cost. How many customers couldn’t access your services because the crooks were using all your processing power?

https://nakedsecurity.sophos.com/2018/03/09/cryptomining-versus-cryptojacking-whats-the-difference/

I guess we will should get used to this message more often

More than 4000 websites, including many belonging to governments around the world, were hijacked this weekend by hackers who managed to plant CoinHive code designed to exploit the computer power of visiting PCs and mine for cryptocurrency.

https://www.grahamcluley.com/government-websites-hijacked-cryptomining-plugin/

Time to use all our (and or office) computers for cryptomining (without authorization?) That's what a few admins decided to do ( maybe, they thought it was no different from watching netflix or youtube )

Better yet, what if you were those sysadmins, and you thought no one would mind all the unaccounted-for megawatt-hours on the next electricity bill? (Or at least hoped they wouldn’t notice?)

According to Russian news agency Interfax, the moonlighting activity of choice for a bunch of rogue workers at the All-Russian Research Institute of Experimental Physics, was cryptomining.



https://nakedsecurity.sophos.com/2018/02/10/have-federal-nuclear-supercomputer-go-cryptomining/