Advertisement
Singapore markets closed
  • Straits Times Index

    3,224.01
    -27.70 (-0.85%)
     
  • Nikkei

    40,369.44
    +201.37 (+0.50%)
     
  • Hang Seng

    16,541.42
    +148.58 (+0.91%)
     
  • FTSE 100

    7,952.62
    +20.64 (+0.26%)
     
  • Bitcoin USD

    69,432.85
    -1,922.73 (-2.69%)
     
  • CMC Crypto 200

    885.54
    0.00 (0.00%)
     
  • S&P 500

    5,254.35
    +5.86 (+0.11%)
     
  • Dow

    39,807.37
    +47.29 (+0.12%)
     
  • Nasdaq

    16,379.46
    -20.06 (-0.12%)
     
  • Gold

    2,254.80
    +16.40 (+0.73%)
     
  • Crude Oil

    83.11
    -0.06 (-0.07%)
     
  • 10-Yr Bond

    4.2060
    +0.0100 (+0.24%)
     
  • FTSE Bursa Malaysia

    1,536.07
    +5.47 (+0.36%)
     
  • Jakarta Composite Index

    7,288.81
    -21.28 (-0.29%)
     
  • PSE Index

    6,903.53
    +5.36 (+0.08%)
     

New Crypto-Mining Malware Targeting Asian Firms With NSA Tools

A new form of malware is targeting enterprises in Asia to mine monero (XMR) cryptocurrency.

Cybersecurity software provider Symantec published the news in a blog post Wednesday, saying that over 80 percent of victims are located in China, with nations such as South Korea, Japan and Vietnam also seeing activity.

Dubbed “Beapy,” the malicious code is a file-based crypto miner, not a browser-based one, the firm said. It works by sending a malicious Excel file to victims as an email attachment, downloading the DoublePulsar backdoor onto the victim’s system if the file is opened.

US Prosecutors Charge 2 Foreign Nationals Over Bitcoin Investment Scam

ADVERTISEMENT

DoublePulsar (notably developed by the U.S. National Security Agency before it was stolen then released to the public in 2017) was also used in the WannaCry ransomware attack in 2017, according to the post.

Once DoublePulsar is installed on to a victim’s machine, the miner is downloaded. At the same time, it uses another leaked NSA tool, EternalBlue, to propagate across the infected network via unpatched computers where it can steal credentials to further access patched machines.

Cryptojacking malware can have a major impact on enterprises, Symantec said, including slowing down device performance, reducing employee productivity and increasing costs.

Although cryptojacking activity has decreased by about 52 percent over the last year, it is still an area of interest among hackers which largely target businesses.

New York State Sees First Conviction for Crypto Money Laundering

Symantec said:

“Looking at the overall figures for cryptojacking, we can see that there were just under 3 million cryptojacking attempts in March 2019. While a big drop from the peak of February 2018, when there were 8 million cryptojacking attempts, it is still a significant figure.”

The firm said it first noticed Beapy in January of this year, but activity has increased since early March.

Monero’s privacy features make it by far the most popular cryptocurrency among hackers deploying mining malware. A recent academic study estimated that cybercriminals have mined around 5 percent of the total monero in circulation.

Earlier this year, researchers at cybersecurity firm Palo Alto Networks discovered a form of malware that takes administrative control to first uninstall cloud security products and then injects code to mine monero. The same team also discovered another variant that steals browser cookies and other information on Apple Mac computers to directly steal cryptocurrencies.

Symantec image via Shutterstock

Related Stories