How Does Cryptojacking Exploit Your Systems?

TL;DR

Cryptojacking turns another party’s computing resources into a source of cryptocurrency mining profit, allowing malicious actors to reduce their own costs. Organizations can identify possible compromise by monitoring unusual mining-related traffic and analyzing changes across customers, industries, business sizes, and geographies, then strengthen cloud resources and guard against malicious JavaScript injections.

Transcript

Okay. So hi everyone, and, um, thank you so much for being here, and more importantly for, um, your interest, for your curiosity into the malicious crypto mining space. And, um, it is one of the fastest growing emerging threats in the entire threat landscape today. Um, it, it is, uh, you know... If you are interested in the space, you have probably... Read More

Key Insights

• Cryptojacking is the malicious use of another party’s computing resources to mine cryptocurrency. Cryptocurrency mining itself is not necessarily malicious or illegal, but unauthorized mining shifts the computing costs to the victim while allowing the attacker to pursue the resulting profit.
• Cryptocurrency mining works by contributing computing power to record transactions in a decentralized database. This process performs a function comparable to a bank recording transactions and maintaining balances, except participants can run software and donate computing capacity without relying on a central financial authority.
• Malicious cryptocurrency mining can grow even when cryptocurrency markets decline. The researchers observed increasing mining activity during a period when the broader market had fallen substantially, showing that malicious activity does not necessarily move in proportion to cryptocurrency market value.
• Cryptocurrency attracts malicious actors because decentralized payments can make it easier to receive funds and remain anonymous. The surrounding market is also highly volatile, under-regulated, and populated by malicious participants, creating conditions the presenters characterize as resembling the Wild West.
• Cryptocurrency regulation lacks global consensus. Some countries question whether cryptocurrencies are legal, some permit financial institutions to participate, and others prohibit such participation, leaving unresolved issues involving taxation, insurance, money laundering, and the rules required for these systems.
• Cryptocurrency exchanges have security measures that are less mature than those used in traditional equity markets, according to the presenters. This gap expands the attack surface and can help malicious actors operate for long periods without detection.
• DNS query analysis can reveal both individual compromises and broad cryptojacking trends. A sudden increase in mining-related traffic can identify an organizational outlier, while comparisons across industries, organization sizes, geographies, and time can show how attacker targeting changes.
• Defending corporate environments requires attention to indicators of compromise, cloud computing security, and malicious JavaScript injection. The stated goal is to help organizations understand why cryptojacking occurs, recognize compromised environments, apply preventive measures, and remediate detected intrusions.

Questions & Answers

Q: What is cryptojacking and how does it work?

Cryptojacking is the unauthorized use of computing resources belonging to another person or organization for cryptocurrency mining. Mining normally involves running software that contributes computing power to record transactions in a cryptocurrency database. The malicious element appears when an attacker takes control of someone else’s resources, avoiding the associated computing costs while pursuing mining profits.

Q: Why do attackers use corporate environments for cryptocurrency mining?

Corporate environments provide computing resources that attackers can use without paying the operating costs themselves. The presenters explain that mining can be profitable when another party supplies those resources. Cryptocurrency also makes it easier for malicious actors to receive payment and remain anonymous, while weak regulation and immature security practices create additional opportunities for prolonged, undetected activity.

Q: How can organizations detect possible cryptojacking activity?

Organizations can look for unusual increases in mining-related network traffic as indicators of possible compromise. The Cisco Umbrella analytics approach organizes and curates query data to identify outliers and trends. A customer that suddenly generates a significant amount of malicious mining traffic can stand out, while comparisons over time can reveal changes in attacker behavior and targeting.

Q: Why can cryptojacking increase when cryptocurrency prices decline?

The observed malicious mining activity did not decline alongside the broader cryptocurrency market. According to the presenters, mining remains attractive because attackers can improve profitability by using someone else’s computing resources. Their costs are shifted to the victim, so malicious activity does not have to rise or fall in direct proportion to the market value of cryptocurrencies.

Q: How does cryptocurrency mining support decentralized transactions?

Cryptocurrency mining helps record transactions in a shared database without requiring a bank to act as the central authority. In a traditional account, a bank records transactions and maintains balances for later reference. In the cryptocurrency model described by the presenters, participants can run software and contribute computing power that helps record transactions in the relevant cryptocurrency database.

Q: Why is limited cryptocurrency regulation a security concern?

Cryptocurrency regulation differs substantially between countries, and there is no global consensus governing the market. Some countries question legality, others allow financial institutions to participate, and others prohibit that participation. The resulting uncertainty affects areas such as taxation, insurance, money laundering controls, and operating rules, contributing to an environment in which malicious actors can exploit gaps.

Q: Why are cryptocurrency exchanges attractive targets for attackers?

Cryptocurrency exchanges represent a significant attack surface because their security measures have not reached the maturity associated with traditional equity markets, according to the presenters. Combined with limited regulation, volatility, and the possibility of anonymous payment, these weaknesses can allow attackers to pursue cryptocurrency-related crime and potentially remain undetected for extended periods.

Q: How should organizations reduce the risk of cryptojacking?

Organizations should monitor for indicators of compromise, especially sudden or unusual mining-related query traffic, and investigate meaningful deviations from established patterns. The presentation also identifies securing cloud computing resources and protecting against malicious JavaScript injection as defensive priorities. When compromise is discovered, organizations need preventive and remediation measures focused on the affected environment and observed malicious activity.

Summary & Key Takeaways

• Cryptocurrency introduced a decentralized payment model in which transactions can occur without a traditional financial institution serving as the central authority. Mining supports this model by contributing computing power to record transactions in a cryptocurrency database. The activity becomes cryptojacking when malicious actors use computing resources belonging to someone else for profit.

• Cryptojacking continued growing despite a substantial decline in the overall cryptocurrency market. The attraction for attackers comes from mining profitability when victims supply the computing resources, combined with an under-regulated market, inconsistent rules between countries, weaker exchange security measures, and opportunities for malicious actors to receive payment while remaining difficult to identify.

• Cisco Umbrella researchers analyze a large and geographically diverse collection of query data to identify mining-related outliers and broader attack trends. Their approach can reveal sudden increases in malicious mining traffic and compare targeting patterns across industries, organization sizes, and locations. Organizations should also secure cloud resources and protect against malicious JavaScript injection.