3.0 KiB
title, description, keywords, ms.prod, ms.mktglfcycl, ms.sitesec, ms.localizationpriority, ms.author, author, ms.date
| title | description | keywords | ms.prod | ms.mktglfcycl | ms.sitesec | ms.localizationpriority | ms.author | author | ms.date |
|---|---|---|---|---|---|---|---|---|---|
| Coin miners | Learn about coin miners, how it works | security, malware | w10 | secure | library | medium | dansimp | dansimp | 08/01/2018 |
Coin miners
Cybercriminals are always looking for new ways to make money. With the rise of digital currencies, also known as cryptocurrencies, criminals see a unique opportunity to infiltrate an organization and secretly mine for coins by reconfiguring malware.
How coin miners work
Many infections start with:
-
Email messages with attachments that try to install malware.
-
Websites hosting exploit kits that attempt to use vulnerabilities in web browsers and other software to install coin miners.
-
Websites taking advantage of computer processing power by running scripts while users browse the website.
Mining is the process of running complex mathematical calculations necessary to maintain the blockchain ledger. This process generates coins but requires significant computing resources.
Coin miners are not inherently malicious. Some individuals and organizations invest in hardware and electric power for legitimate coin mining operations. However, others look for alternative sources of computing power and try to find their way into corporate networks. These coin miners are not wanted in enterprise environments because they eat up precious computing resources.
Cybercriminals see an opportunity to make money by running malware campaigns that distribute, install, and run trojanized miners at the expense of other people’s computing resources.
Examples
DDE exploits, which have been known to distribute ransomware, are now delivering miners.
For example, a sample of the malware detected as Trojan:Win32/Coinminer (SHA-256: 7213cbbb1a634d780f9bb861418eb262f58954e6e5dca09ca50c1e1324451293) is installed by Exploit:O97M/DDEDownloader.PA, a Word document that contains the DDE exploit.
The exploit launches a cmdlet that executes a malicious PowerShell script (Trojan:PowerShell/Maponeir.A), which then downloads the trojanized miner: a modified version of the miner XMRig, which mines Monero cryptocurrency.
How to protect against coin miners
Enable PUA detection: Some coin mining tools are not considered malware but are detected as potentially unwanted applications (PUA). Many applications detected as PUA can negatively impact machine performance and employee productivity. In enterprise environments, you can stop adware, torrent downloaders, and coin mining by enabling PUA detection.
Since coin miners is becoming a popular payload in many different kinds of attacks, see general tips on how to prevent malware infection.
For more information on coin miners, see the blog post Invisible resource thieves: The increasing threat of cryptocurrency miners.