Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

New Crypto-Mining Attacks Leverage NSA-Linked EternalBlue Exploit

A new version of the NRSMiner is actively spreading in the southern region of Asia. The majority of detections (54%) have been found in Vietnam, followed by Iran (16%) and Malaysia (12%). The new version either updates existing NRSMiner infections, or spreads to new systems using the EternalBlue exploit.

A new version of the NRSMiner is actively spreading in the southern region of Asia. The majority of detections (54%) have been found in Vietnam, followed by Iran (16%) and Malaysia (12%). The new version either updates existing NRSMiner infections, or spreads to new systems using the EternalBlue exploit.

EternalBlue, one of the NSA exploits stolen by the Shadow Brokers and leaked to the public, is infamously known for the WannaCry and NotPetya outbreaks in 2017. It was patched by Microsoft in March 2017, leaked by Shadow Brokers in April 2017, and used by WannaCry in May 2017.

That EternalBlue is still being used to spread malware nearly two years after it was patched by Microsoft points to a massive failure in patching.

“Falling behind basic security practices, like patching, is usually the main culprit in these situations,” Jarno Niemela, principal researcher ata F-Secure Labs told SecurityWeek. “And use of pirated software and how popular Windows is compared to other platforms are probably playing a role here.”

However, he continued, “I think the biggest reason this is limited to certain countries has to do with resourcing. Security investments help ensure IT admins have time and money to create and maintain secure systems. And investments that build a culture of security is how those resources become allocated. Some parts of the world have invested in security education for decades, and we don’t see this malware achieving the same prevalence in those regions.”

The new version of NRSMiner is discussed by F-Secure researcher Neeraj Singh in a report published today. It updates existing infections by downloading new modules and deleting the files and services installed by its own previous versions. Existing infections with the wmassrv service running will connect to tecate[.]traduires[.]com to download an updater module.

The updater module checks to see if the new version is already installed. If it is, it deletes itself. If not, it downloads the malware from one of a series of hardcoded URLs. This malware performs the necessary housekeeping before installing a service named snmpstorsrv, with snmpstorsrv.dll registered as servicedll. It then deletes itself.

The new service creates multiple threads for different purposes, including the exfiltration of processor and system information, checking for a new module, and running the miner. The updated miner is injected into svchost.exe to start crypto-mining. If this fails, the miner is written to TrustedHostex.exe in the system32 folder and executed.

snmpstorsrv also decompresses a wininit.exe file and ejects it into svchost.exe. Failing this, wininit is written to AppDiagnosticswininit.exe and executed. Wininit is responsible for further propagation. One of the files it unzips and places in the AppDiagnostics folder is called svchost.exe but is actually the EternalBlue – 2.2.0 exploit executable.

Wininit.exe scans the local network on TCP port 445 looking for other accessible devices, and executes the EternalBlue exploit on any found and vulnerable systems. If successful, it installs the DoublePulsar backdoor on the new system. The new system is infected, and the process begins again.

The cryptominer used is the XMRig Monero CPU miner, employed to generate units of the Monero cryptocurrency. Monero has suffered the same decline in value experienced by all cryptocurrencies during 2018, peaking at around $542 in January 2018 and currently trading at less than $50. Nevertheless, it is gaining in popularity for both legitimate and illegitimate reasons.  

On January 1, 2019, Monero tweeted, “The official Fortnite Merch Store is now exclusively accepting #Monero as a cryptocurrency payment option!” Fortnite is an online video game developed by Epic Games and released in July 2017. It reportedly has 125 million players throughout the world.

The bad guys simply like the increased privacy Monero provides over Bitcoin.

Related: NSA Leak Fuels Rise in Hacking for Crypto Mining: Report 

Related: Crypto-Mining Attack Targets Web Servers Globally 

Related: $175 Million in Monero Mined via Malicious Programs: Report 

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.