A new crypto-currency miner – PowerGhost – which has hit corporate networks in several regions, mostly in Latin America, has been uncovered.
Crypto-currency miners are a hot cybersecurity topic right now, according to Kaspersky lab researchehrs.
This specialist “mining” software creates new coins by using the computing power of a victim PC and mobile devices. Malicious miners do so at the expense of other users, capitalising on the power of their computers and devices without their knowledge. The threat has skyrocketed in recent times, replacing ransomware as the main type of malicious software, as previous Kaspersky Lab research has shown.
However, the emergence of PowerGhost adds a new dimension to the trend. It demonstrates that malicious miner developers are shifting to targeted attacks to make more money, as Kaspersky Lab researchers had previously predicted.
PowerGhost is distributed within corporate networks, infecting both workstations and servers. The main victims of this attack so far have been corporate users in Brazil, Colombia, India, and Turkey. PowerGhost uses multiple fileless techniques to discreetly gain a foothold in corporate networks – meaning that the miner does not store its body directly onto a disk, increasing the complexity of its detection and remediation.
Machine infection occurs remotely through exploits or remote administration tools. When the machine is infected, the main body of the miner is downloaded and run without being stored on the hard disk. Once this has happened, cybercriminals can arrange for the miner to automatically update, spread within the network, and launch the crypto-mining process.
“PowerGhost attacks on businesses, for the purpose of installing miners, raise new concerns about crypto-mining software. The miner we examined indicates that targeting users is not enough – cybercriminals are now turning their attention to enterprises too. And this makes crypto-currency mining a threat to the business community,” says Vladas Bulavas, malware analyst at Kaspersky Lab.
Kaspersky Lab products detect the threat as:
* PDM:Trojan.Win32.Generic;
* PDM:Exploit.Win32.Generic;
* HEUR:Trojan.Win32.Generic; and
* not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen.