Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

New Crypto-Mining Attacks Leverage NSA-Linked EternalBlue Exploit

A new version of the NRSMiner is actively spreading in the southern region of Asia. The majority of detections (54%) have been found in Vietnam, followed by Iran (16%) and Malaysia (12%). The new version either updates existing NRSMiner infections, or spreads to new systems using the EternalBlue exploit.

A new version of the NRSMiner is actively spreading in the southern region of Asia. The majority of detections (54%) have been found in Vietnam, followed by Iran (16%) and Malaysia (12%). The new version either updates existing NRSMiner infections, or spreads to new systems using the EternalBlue exploit.

EternalBlue, one of the NSA exploits stolen by the Shadow Brokers and leaked to the public, is infamously known for the WannaCry and NotPetya outbreaks in 2017. It was patched by Microsoft in March 2017, leaked by Shadow Brokers in April 2017, and used by WannaCry in May 2017.

That EternalBlue is still being used to spread malware nearly two years after it was patched by Microsoft points to a massive failure in patching.

“Falling behind basic security practices, like patching, is usually the main culprit in these situations,” Jarno Niemela, principal researcher ata F-Secure Labs told SecurityWeek. “And use of pirated software and how popular Windows is compared to other platforms are probably playing a role here.”

However, he continued, “I think the biggest reason this is limited to certain countries has to do with resourcing. Security investments help ensure IT admins have time and money to create and maintain secure systems. And investments that build a culture of security is how those resources become allocated. Some parts of the world have invested in security education for decades, and we don’t see this malware achieving the same prevalence in those regions.”

The new version of NRSMiner is discussed by F-Secure researcher Neeraj Singh in a report published today. It updates existing infections by downloading new modules and deleting the files and services installed by its own previous versions. Existing infections with the wmassrv service running will connect to tecate[.]traduires[.]com to download an updater module.

The updater module checks to see if the new version is already installed. If it is, it deletes itself. If not, it downloads the malware from one of a series of hardcoded URLs. This malware performs the necessary housekeeping before installing a service named snmpstorsrv, with snmpstorsrv.dll registered as servicedll. It then deletes itself.

The new service creates multiple threads for different purposes, including the exfiltration of processor and system information, checking for a new module, and running the miner. The updated miner is injected into svchost.exe to start crypto-mining. If this fails, the miner is written to TrustedHostex.exe in the system32 folder and executed.

Advertisement. Scroll to continue reading.

snmpstorsrv also decompresses a wininit.exe file and ejects it into svchost.exe. Failing this, wininit is written to AppDiagnosticswininit.exe and executed. Wininit is responsible for further propagation. One of the files it unzips and places in the AppDiagnostics folder is called svchost.exe but is actually the EternalBlue – 2.2.0 exploit executable.

Wininit.exe scans the local network on TCP port 445 looking for other accessible devices, and executes the EternalBlue exploit on any found and vulnerable systems. If successful, it installs the DoublePulsar backdoor on the new system. The new system is infected, and the process begins again.

The cryptominer used is the XMRig Monero CPU miner, employed to generate units of the Monero cryptocurrency. Monero has suffered the same decline in value experienced by all cryptocurrencies during 2018, peaking at around $542 in January 2018 and currently trading at less than $50. Nevertheless, it is gaining in popularity for both legitimate and illegitimate reasons.  

On January 1, 2019, Monero tweeted, “The official Fortnite Merch Store is now exclusively accepting #Monero as a cryptocurrency payment option!” Fortnite is an online video game developed by Epic Games and released in July 2017. It reportedly has 125 million players throughout the world.

The bad guys simply like the increased privacy Monero provides over Bitcoin.

Related: NSA Leak Fuels Rise in Hacking for Crypto Mining: Report 

Related: Crypto-Mining Attack Targets Web Servers Globally 

Related: $175 Million in Monero Mined via Malicious Programs: Report 

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...