There's The Pirate Bay, Chrome-compatible extensions, and CBS's Showtime. What's next for this wave of background miners? According to ESET, servers based on Windows Server 2003 R2 that haven't received the corresponding patches are the new targets. The most recent operation stayed active for three months and generated the equivalent of $63,000 in Monero, one of the most popular cryptocurrencies at the moment.
The genie is out of the bottle; there's no other way to describe it. Cryptomining has become attractive not only because of the current value of the coins, but also because it's relatively easy to carry out. The tools are open source, work very well, and with a few adjustments in a configuration file, the rest comes down to double-clicking the executable. Services like Coinhive allow mining to be integrated into the code of any web page or online service, and as expected, attacks to install cryptominers on 24/7 systems are multiplying. Campaigns target a wide number of terminals working at low intensity, and even though security solutions detect miners without much effort, they're having a lot of success.
The Attack in Detail
The latest report comes from ESET, which detected an operation that started in May. The attackers slightly modified version 0.8.2 of the open source miner XMRig, which uses processor resources to generate Monero (XMR). In essence, they inserted the mining pool address, the wallet where the coins should be transferred, and a special command that interrupts the process of any other competing cryptominer. The deployment was made possible thanks to CVE-2017-7269, a vulnerability discovered in March 2017 in the WebDAV service of Microsoft IIS 6.0, used by Windows Server 2003 R2. All versions of Windows 2003 ended their extended support in July 2015, but a hotfix is available.
In summary, the attack focused on unprotected Windows Server 2003 R2 servers, and in three months they produced 414.98 XMR, which at its highest price was worth $63,000. The exact number of infected servers is unknown, but based on hashrate it's estimated to be in the hundreds. The campaign's mining power is already dropping because XMRig has no persistence and is easy to eliminate, but it's only a matter of time before they implement something more robust and stealthy.
