Published by Gbaf News
Posted on June 28, 2018
10 min readLast updated: January 21, 2026
Add as preferred source on Google
Cryptocurrency Mining and Cryptojacking Offer Cybercriminals Lower Risk, Higher Efficacy, Ease of Monetization of Efforts; Adding Passive Exploitation to Portolio of Ransomware Extortion, Data Breach Theft, and Fraud
NEWS HIGHLIGHTS
Dubai, United Arab Emirates –McAfee, the device-to-cloud cybersecurity company, today released its McAfee Labs Threats Report: June 2018, examining the growth and trends of new malware, ransomware, and other threats in Q1 2018. McAfee Labs saw on average five new threat samples every second, including growth in crypto jacking and other cryptocurrency mining malware, and notable campaigns demonstrating a deliberate drive to technically improve upon the most sophisticate established attacks of 2017.
“There were new revelations this quarter concerning complex nation-state cyber-attack campaigns targeting users and enterprise systems worldwide,” said Raj Samani, chief scientist at McAfee.“Bad actors demonstrated a remarkable level of technical agility and innovation in tools and tactics. Criminals continued to adopt cryptocurrency mining to easily monetize their criminal activity.”
Cybercriminals extended their operations in crypto jacking and other cryptocurrency mining schemes, where perpetrators hijack victims’ browsers or infect their systems to secretly use them to mine for legitimate cryptocurrencies such as Bitcoin. This category of coinminermalware grew a stunning 629% in the first quarter of 2018, rocketing from around 400,000 total known samples in Q4 2017 to more than 2.9 million the next quarter. This suggests that cybercriminals are continuing to warm to the prospect simply infecting users’ systems and collecting payments without having to rely on third parties to monetize their crimes.
“Cybercriminals will gravitate to criminal activity that maximizes their profit,” said Steve Grobman, chief technology officer at McAfee. “In recent quarters we have seen a shift to ransomware from data-theft, as ransomware is a more efficient crime. With the rise in value of cryptocurrencies , the market forces are driving criminals to crypto-jacking and the theft of cryptocurrency. Cybercrime is a business, and market forces will continue to shape where adversaries focus their efforts.”
Bitcoin-stealing campaigns
The Lazarus cybercrime ring launched a highly sophisticated Bitcoin-stealing phishing campaign—HaoBao—which targeted global financial organizations and Bitcoin users. When recipients open malicious email attachments, an implant would scan for Bitcoin activity and establishes an implant for persistent data gathering and crypto mining.
Raj Samani, chief scientist at McAfee
Gold Dragon: Attacks on South Korea
In January, McAfee Advanced Threat Research reported an attack targeting organizations involved in the Pyeongchang Winter Olympics in South Korea. The attack was executed via a malicious Microsoft Word attachment containing a hidden PowerShell implant script. The script was embedded within an image file and executed from a remote server. Dubbed Gold Dragon, the resulting fileless implant encrypted stolen data, sent the data to the attackers’ command and control servers, performed reconnaissance functions, and monitored anti-malware solutions to evade them.
Hidden Cobra: GhostSecret and Bankshot
Operation GhostSecret targeted the healthcare, finance, entertainment, and telecommunications sectors. Operation GhostSecret is believed to be associated with the international cybercrime group known as Hidden Cobra. The campaign, which employs a series of implants to appropriate data from infected systems, is also characterized by its ability to evade detection and throw forensic investigators off its trail. The latest Bankshot variation of GhostSecret uses an embedded Adobe Flash exploit to enable the execution of implants. It also incorporates elements of the Destover malware, which was used in the 2014 Sony Pictures attack, and the Proxysvc implant, a previously undocumented implant that has operated undetected since mid-2017.
Security Incidents by Industry
McAfee Labs counted 313 publicly disclosed security incidents in Q1 2018, a 41% increase over Q4. Incidents involving multiple sectors (37) and those targeting multiple regions (120) were the leading types of incidents in Q1.
Other Q1 2018 ThreatActivity
In Q1 2018, McAfee Labs recorded, on average, five new malware samples per second, including threats showing notable technical developments improving upon the latest successful technologies and tactics to outmaneuver their targets’ defenses.
Cryptocurrency Mining and Cryptojacking Offer Cybercriminals Lower Risk, Higher Efficacy, Ease of Monetization of Efforts; Adding Passive Exploitation to Portolio of Ransomware Extortion, Data Breach Theft, and Fraud
NEWS HIGHLIGHTS
Dubai, United Arab Emirates –McAfee, the device-to-cloud cybersecurity company, today released its McAfee Labs Threats Report: June 2018, examining the growth and trends of new malware, ransomware, and other threats in Q1 2018. McAfee Labs saw on average five new threat samples every second, including growth in crypto jacking and other cryptocurrency mining malware, and notable campaigns demonstrating a deliberate drive to technically improve upon the most sophisticate established attacks of 2017.
“There were new revelations this quarter concerning complex nation-state cyber-attack campaigns targeting users and enterprise systems worldwide,” said Raj Samani, chief scientist at McAfee.“Bad actors demonstrated a remarkable level of technical agility and innovation in tools and tactics. Criminals continued to adopt cryptocurrency mining to easily monetize their criminal activity.”
Cybercriminals extended their operations in crypto jacking and other cryptocurrency mining schemes, where perpetrators hijack victims’ browsers or infect their systems to secretly use them to mine for legitimate cryptocurrencies such as Bitcoin. This category of coinminermalware grew a stunning 629% in the first quarter of 2018, rocketing from around 400,000 total known samples in Q4 2017 to more than 2.9 million the next quarter. This suggests that cybercriminals are continuing to warm to the prospect simply infecting users’ systems and collecting payments without having to rely on third parties to monetize their crimes.
“Cybercriminals will gravitate to criminal activity that maximizes their profit,” said Steve Grobman, chief technology officer at McAfee. “In recent quarters we have seen a shift to ransomware from data-theft, as ransomware is a more efficient crime. With the rise in value of cryptocurrencies , the market forces are driving criminals to crypto-jacking and the theft of cryptocurrency. Cybercrime is a business, and market forces will continue to shape where adversaries focus their efforts.”
Bitcoin-stealing campaigns
The Lazarus cybercrime ring launched a highly sophisticated Bitcoin-stealing phishing campaign—HaoBao—which targeted global financial organizations and Bitcoin users. When recipients open malicious email attachments, an implant would scan for Bitcoin activity and establishes an implant for persistent data gathering and crypto mining.
Raj Samani, chief scientist at McAfee
Gold Dragon: Attacks on South Korea
In January, McAfee Advanced Threat Research reported an attack targeting organizations involved in the Pyeongchang Winter Olympics in South Korea. The attack was executed via a malicious Microsoft Word attachment containing a hidden PowerShell implant script. The script was embedded within an image file and executed from a remote server. Dubbed Gold Dragon, the resulting fileless implant encrypted stolen data, sent the data to the attackers’ command and control servers, performed reconnaissance functions, and monitored anti-malware solutions to evade them.
Hidden Cobra: GhostSecret and Bankshot
Operation GhostSecret targeted the healthcare, finance, entertainment, and telecommunications sectors. Operation GhostSecret is believed to be associated with the international cybercrime group known as Hidden Cobra. The campaign, which employs a series of implants to appropriate data from infected systems, is also characterized by its ability to evade detection and throw forensic investigators off its trail. The latest Bankshot variation of GhostSecret uses an embedded Adobe Flash exploit to enable the execution of implants. It also incorporates elements of the Destover malware, which was used in the 2014 Sony Pictures attack, and the Proxysvc implant, a previously undocumented implant that has operated undetected since mid-2017.
Security Incidents by Industry
McAfee Labs counted 313 publicly disclosed security incidents in Q1 2018, a 41% increase over Q4. Incidents involving multiple sectors (37) and those targeting multiple regions (120) were the leading types of incidents in Q1.
Other Q1 2018 ThreatActivity
In Q1 2018, McAfee Labs recorded, on average, five new malware samples per second, including threats showing notable technical developments improving upon the latest successful technologies and tactics to outmaneuver their targets’ defenses.
Explore more articles in the Technology category
