View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

Hackers Force Supercomputers Offline in Multiple Breaches

Supercomputers turn superminers for crypto crims.

By CBR Staff Writer

The discovery of cryptomining operations has forced supercomputing clusters across the world offline in an incident that exposes the poor security of some of the world’s most powerful research machines.

The incident appears to have involved cybercriminals distributing malware by taking advantage of compromised SSH credentials (SSH is a network protocol that gives users secure remote access to systems).

The UK’s ARCHER was among those forced out of service as security teams scrambled to flush malware out of its system. (ARCHER, an aging Cray XC30 machine, is used for research purposes by a wide range of universities).

ARCHER’s team noted: “All of the existing ARCHER passwords and SSH keys will be rewritten and will no longer be valid on ARCHER.

“There will be a new requirement to connect to ARCHER using a SSH key and a password.” Crucially they noted that: “The ARCHER incident is part of a much broader issue involving many other sites in the UK and internationally.”

Indeed it does appear to be part of a much broader attack on supercomputing infrastructure across the world: In Germany bwHPC, a supercomputing research coordination organisation, reported that five of its clusters were also forced offline by the need to deal with a “security incident”.


Cryptomining attacks involve a hacker hi-jacking computational power to process cryptocurrency transactions and earn coins in compensations for the heavy calculations and energy used in the process.

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

The computational requirements to mine cryptocurrencies like Bitcoin is significant: as the Bank for International Settlements noted last year, the total energy consumption needed to mine Bitcoins globally was the equivalent of a mid-sized economy such as Switzerland.

European Grid Infrastructure (EGI), a EU group that helps to coordinate projects and research endeavours on supercomputers across the EU, noted in a security updated that the attackers are jumping from ‘one victim to another’ as they exploit compromised SSH credentials.

Compromised SSH credentials from universities in Canada, China, and Poland are thought to be one of the main points of access in the incidents reported by firms across the EU. EGI identified four distinct ways in which the attackers were exploiting the compromised supercomputer infrastructure.

  • XMR mining hosts (running a hidden XMR binary) XMR-proxy hosts; The attacker uses these hosts from the XMR mining hosts, to connect to other.
  • XMR-proxy hosts and eventually to the actual mining server.
  • SOCKS proxy hosts (running a microSOCKS instance on a high port) ; The attacker connects to these hosts via SSH, often from Tor. MicroSOCKS is used from Tor as well.
  • Tunnel hosts (SSH tunneling); The attacker connects via SSH (compromised account) and configure NAT PREROUTING (typically to access private IP spaces).

Jake Moore, Cybersecurity Specialist at ESET told Computer Business Review that: “What’s interesting about this is that it seems hackers have targeted the supercomputers completely remotely for the first time, as before there has always been an insider who installs the crypto mining malware.

“All the SSH login credentials will now need resetting, which may take a while, but this is vital to stop further attacks.

“Once a list of credentials is compromised, it is a race against time to have these reset. Unfortunately, the lead time is usually enough of a head start for threat actors to take advantage of the mining software.”

See Also: Cryptomining Attacks Hit 40 percent of Enterprises in 2018 Report Finds

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.