Website security audits specialists have detected a long-range cryptojacking campaign; it is reported that the threat actors behind this campaign, allegedly Chinese hackers, have already infected more than 50k servers in less than four months.
Researchers have dubbed this campaign of attacks as “Nansh0u” because of a string of text files on the attacker’s servers; “this is not a regular cryptocurrency-mining campaign”, the specialists say.
The malware distributed by attackers is used to mine an open source code cryptocurrency called TurtleCoin; to deploy the mining software attackers have decided to resort to sophisticated techniques mainly used by groups of government-sponsored hackers, such as the use of certificates and multiple different versions of the payload.
“So far we have identified more than 50k compromised servers belonging to companies in various sectors, such as telecommunications, health care, media and IT companies”, commented the website security audits specialists. According to the report of the investigators, after the server is infected the mining software is loaded and a rootkit is installed to guarantee the persistence of the malware.
As for the search for targets for the attack, hackers scan the Internet to locate open ports on MS-SQL servers and then gain access using brute force attacks. Subsequently, hackers execute arbitrary commands on compromised systems and unload payloads and mining software from a remote server.
The main goal of the attackers is the cryptocurrency mining, the website security audits specialists mentioned. However, it is not ruled out that, as a result of the attack techniques used, hackers get information about the compromised servers that may be useful in future attacks. Due to the characteristics of TurtleCoin, which is a virtual asset with a specific focus on privacy, it is difficult to calculate the revenue that this campaign has generated for the attackers.
Experts from the International Institute of Cyber Security (IICS) consider this to be one more example of the need to implement more reliable authentication measures in critical systems. For malicious hacker groups it is relatively easy to break the security of the username-password formula, so admins need to consider other authentication methods.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
