As cryptocurrencies become mainstream, CISOs must address cryptojacking threat

Unlike other forms of cybercrime, the goal of those pursuing cryptojacking is to remain hidden throughout an attack’s lifespan, targeting an enterprise’s processing power rather than its private data. Darktrace’s director of analysis, Oakley Cox, discusses the unique security challenges this presents, the potential costs of failing to detect cryptojacking, and the role that self-learning AI can play in detecting these “low and slow” attacks.

Has the ongoing rise in crypto value and profile prompted increased criminal activity such as cryptojacking in this space?

As the value of cryptocurrencies, particularly Bitcoin, continues to surge, cybercriminals have invested in more cryptocurrency-related attack methods. It has become increasingly difficult to mine Bitcoin profitably and efficiently on commodity hardware such as laptops, smartphones, or desktop computers.

To meet this challenge, attackers have turned to cryptojacking, deploying cryptomining malware within target organisations’ digital infrastructures and using an organisation’s devices to illicitly mine cryptocurrency for profit. One such example is Monero-Mining malware, which moves laterally across devices on an infected network. The malware uses laptops and workstations to profitably mine Monero cryptocurrency while deploying ransomware encryptions on affected devices.

How profitable can a cryptojacking attack be?

Although not as immediately profitable as ransomware, cryptomining can be secretly pursued in a target environment for months without causing evident business disruption or drawing attention. A botnet of infected devices mining cryptocurrency on multiple devices and targeting numerous organisations can go undetected by traditional security tools, allowing malicious actors to make a sustained profit.

Digital estates containing many Internet-facing servers and other IoT devices, each of which attackers can leverage to covertly mine cryptocurrencies, have proven attractive targets. During the pandemic, vacant offices and workspaces with unattended devices have proven to be a treasure-trove for attackers seeking to use corporate infrastructures for cryptojacking.

Does that failure to detect present serious dangers to a compromised network?

The delay in detecting cryptojacking means attackers may have sustained access to a target organisation’s digital environment for weeks, months, and even years. In addition to the burdens of lower device performance, high energy usage, and the associated negative financial implications, businesses may experience other attacks via the same existing vulnerability used to deploy the cryptomining malware.

Malicious actors are known to sell access to organisations’ digital assets via underground markets, and cryptomining offers an easy way to make a quick buck while the seller waits for the right offer. Other analysts have reported cryptomining malware actively hunting for rival mining malware already installed on a device and removing it before initiating its own processes, revealing how easy it is for attackers to leverage vulnerabilities multiple times.

Is there such a thing as a typical attack type?

Attackers can deploy cryptojacking attacks across a variety of vectors. Across customer environments, Darktrace has detected employees misusing corporate resources to mine cryptocurrencies for personal gain and compromised websites hijacking visitors’ computing power for cryptomining. Darktrace detected anomalous cryptomining behaviour on a corporate system in one customer environment and traced the activity to a warehouse containing several unassuming cardboard boxes. Hidden within these boxes were several servers operating as a cryptocurrency farm, hijacking the company’s power resources to mine Monero.

How high on a CISO’s agenda should cryptojacking sit?

While other threats currently rank higher, cryptojacking and other crypto-related attacks are an evolving threat type. In 2018, Darktrace detected a range of incidents where employees intentionally installed cryptomining software on their corporate devices to mine for personal gain. These employees do not have to pay for the electricity used to run the corporate device in the office – they are basically turning their employer’s electricity into cash by commandeering it.

More recently, opportunistic hackers are deploying cryptomining malware to profit from the soaring value of cryptocurrencies. As employees return to the office and cryptocurrencies become more mainstream, rogue employees and hackers alike will become more interested in leveraging corporate power sources.

To what extent does the attacker’s intention to stay completely hidden negate traditional security measures?

Traditional security tools are innately backwards-facing; they rely on historical rules and signatures to detect known “bad”. Even AI security tools based on supervised machine learning only identify threats based on a pre-programmed list of malicious behaviours. As attackers innovate, they confound traditional tools because their attacks do not operate traditionally.

Malicious actors deploying cryptomining malware strive to remain hidden, using novel mining malware unfamiliar to traditional tools and mimicking normal user behaviours closely to stay unnoticed. For example, Darktrace recently detected multiple devices in the OutLaw botnet leveraged for cryptomining. The attack actively excluded computers with lightweight hardware architecture, indicating that the attacker wanted to avoid targeting small devices like phones and tablets, on which the malware is likely to be less profitable and more easily detected.

So, what preventative and detection steps should security leaders be taking?

In addition to setting strict policies of cyber-hygiene and appropriate use of corporate networks, security leaders must invest in cyber security tools like self-learning AI, which can detect low and slow attacks where attackers remain hidden on targeted digital infrastructure for extended periods. This AI learns normal behaviours across an organisation’s entire digital infrastructure and uses its understanding of that “normal” to detect, flag, and disrupt subtle, anomalous behaviours indicative of cyber threats.

Why is autonomous response particularly valuable in this space?

Autonomous response AI is a force multiplier for human security teams, protecting their respective organisations from advanced cyber threats. In the case of cryptojacking, AI can detect early and subtle signs of a cyber breach, immediately isolating affected devices and limiting further actions attackers might take to deploy cryptomining malware. In environments where cryptojacking is already occurring, autonomous response technology can isolate devices infected with cryptomining malware, removing the ability for these devices to communicate with others in the digital environment to spread the malware.