What is cryptomalware and how to avoid it?.
Contents
Nine times out of ten, getting rid of crypto malware is just as difficult as detecting it.
Would you suspect a sudden drop in your computer’s performance?
Many won’t! Similarly, only a few care enough about the occasional lag and usually label it as “standard” issues with their operating system.
However, if you investigate further, it can also emerge as a rogue application, which eats up your bandwidth and reduces system performance.
What is cryptomalware?
You may assume that cryptomalware is a digital leech injected by a third-party beneficiary that drains your computing resources without your knowledge.
However, the process is more commonly known as crypto-jacking.
As has already been said, what makes its detection difficult is its modus operandi. You can’t tell the difference unless you are very aware of the standard operating sound, speed, etc. of your computer’s fan, and overall system performance.
This will run cryptomining apps in the background for the life of your machine unless you hit uninstall.
Simply put, cryptominers are apps that contribute to the crypto world by verifying your transactions and mining new coins. This generates passive income for your operators.
But these are known as cryptomalware if they get installed on a system without proper authorization from the administrator which makes it a cyber crime.
For a simpler analogy, consider someone who uses your lawn to plant a fruit tree, takes water and necessary supplies from your home without your consent, and denies you fruit or money.
That will be similar to the crypto-jacking of this deadly world.
How does cryptomalware work?
Like most malware!
You do not search for virus-infected downloads or install them for fun.
But they happen to you in the most mundane ways:
- Click a link in the email
- Visit HTTP websites
- Download from unsafe sources
- Clicking on a suspicious ad and other things
Furthermore, bad actors could implement social engineering to force users to download such malware.
Once installed, cryptomalware takes advantage of your system resources until it is detected and uninstalled.
Some signs of cryptomalware infection are increased fan speed (noise), increased heating, and slow performance.
Crypto-malware vs. Crypto-ransomware
Crypto-ransomware is not that subtle. Once installed, you can block it from the system only to allow access after you pay the ransom amount.
It usually displays a contact number or email or account details to cooperate with the ransom threat.
Depending on what is at stake, people sometimes meet with the scammer to get it back. However, there are cases where accepting such “requests” did not provide any relief or also made them a future goal.
Cryptomalware, by contrast, does not pose a visible threat. It works silently in the background, consuming your resources to become a perennial passive source of income for the cybercriminal.
Popular cryptomalware attacks
These are some of the documented events that shook the digital world with its sophistication.
#one. graboid
Graboid was detected by Palo Alto network researchers and published in a 2019 report. The attacker took nearly 2,000 insecure Docker hosts for a free ride that did not require authorization.
Sent remote commands to download and deploy infected docker images to the compromised hosts. The ‘download’ also contained a tool to communicate with and compromise other vulnerable machines.
The ‘modified’ containers then downloaded four scripts and executed them in order.
These scripts randomly operated Monero miners for repeated 250-second sessions and spread the malware across the network.
#2. phantompower
Exposed by Kaspersky Labs in 2018, PowerGhost is a fileless cryptomalware that mainly targets corporate networks.
It is fileless, which means it sticks to machines without attracting unwanted attention or detection. It then logs in to the devices via Windows Management Instrumentation (WMI) or the EthernalBlue exploit used in the infamous WannaCry ransomware attack.
Once logged in, it attempted to disable other miners (if any) in order to gain maximum performance for the bad actors responsible.
In addition to being a resource hog, a variant of PowerGhost was known to host DDoS attacks targeting other servers.
#3. BadShell
BadShell was discovered by Comodo’s cybersecurity division in 2018. It is another fileless crypto worm that leaves no trace on system storage; instead, it operates through the CPU and RAM.
It was attached to Windows PowerShell to execute malicious commands. It stored the binary code in the Windows Registry and ran cryptomining scripts with the Windows Task Scheduler.
#4. Prometei botnet
First detected in 2020, the Prometei Botnet targeted published vulnerabilities in Microsoft Exchange to install cryptomalware to mine Monero.
This cyber attack used many tools such as EternalBlue, BlueKeep, SMB and RDP etc. to propagate through the network and target unsafe systems.
It had many versions (like most malware), and Cybereason researchers date its origins to 2016. Furthermore, it has a cross-platform presence, infecting both Windows and Linux ecosystems.
How to detect and prevent cryptomalware?
The best way to check for crypto malware is by keeping an eye on your system. An increased voice from fans or a sudden drop in performance can spawn these digital worms.
However, operating systems are complex entities, and these things keep happening in the background, and we usually don’t notice such subtle changes.
In that case, here are some tips that can help keep you safe:
- Keep your systems up to date. Outdated software often has vulnerabilities exploited by cybercriminals.
- Use a premium antivirus. I cannot stress enough how every device needs a good antivirus. Furthermore, such attacks occur regardless of the operating system (Mac is also attacked!) and the type of device (smartphones, tablets included).
- Don’t click everything. Being curious is a human nature that is often unfairly taken advantage of. If it’s unavoidable, copy and paste the suspicious link into any search engine and see if it needs further attention.
- Respect browser warnings. Web browsers are much more advanced than they were a decade ago. Try not to void any warnings without proper due diligence. Also, stay away from HTTP websites.
- Stay informed. These tools receive regular updates from the bad guys. In addition, their methods of victimization also evolve. So, keep reading about recent hacks and share them with your mates.
Crypto-Malware is on the rise!
This is due to the increasing adoption of cryptography and its difficult detection.
And once installed, they keep generating free money for crypto criminals with little to no effort on your part.
However, the internet best practices listed above will help keep you safe.
And as already mentioned, it would be best to install cybersecurity software on all your devices.
Check out the introduction to cybersecurity basics for beginners below.
