Monero

WazirX

Cybersecurity researchers have discovered a novel method used by hackers to deliver malware for stealthy crypto mining, leveraging automated email replies.
Researchers from the threat intelligence firm Facct <a data-ct-non-breakable="null" href="https://habr.com/ru/companies/f_a_c_c_t/news/843614/" rel="nofollow noopener" target="_blank" text="null" title="https://habr.com/ru/companies/f_a_c_c_t/news/843614/">reported</a> that hackers exploited auto-reply emails from compromised accounts to target Russian companies, marketplaces and financial institutions.&nbsp;
Using this tactic, the attackers sought to install the XMRig miner on their victims’ devices to mine digital assets.
<figure>
 <img alt="Email auto-reply vulnerability allows hackers to mine cryptocurrency" name="" src="https://s3.cointelegraph.com/uploads/2024-09/019228b8-f3a9-75e4-893f-82c69ea9fe91">
 <figcaption style="text-align: center;">
 An example of an auto-reply letter with a link to malware Source: Habr
 </figcaption>
</figure>
The security company said it had identified 150 emails containing XMRig since the end of May. However, the cybersecurity firm also said that its business email protection system blocked malicious emails sent to its clients.
<h2 id="the-danger-of-auto-replies-with-malware">The danger of auto-replies with malware</h2>
Facct senior analyst Dmitry Eremenko explained that the delivery method is dangerous because potential victims initiate the communications. With normal mass-delivered messages, the targets have the option to ignore emails that they deem irrelevant.&nbsp;
However, with the auto-replies, victims expect a response from the person they emailed first, not knowing that the email they are contacting is compromised. Eremenko said:&nbsp;
<blockquote>
 “In this case, although the letter does not look convincing, communication has already been established, and the file distribution may not arouse particular suspicion.”
</blockquote>
The cybersecurity firm urged companies to conduct regular training to increase employees’ knowledge of cybersecurity and current threats. The firm also urged firms to use strong passwords and multifactor authentication mechanisms.&nbsp;
In a previous interview, ethical hacker Marwan Hachem told Cointelegraph that using different communications devices can also help with security. It <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-security-tips-social-engineering" rel="" target="_self" text="null" title="https://cointelegraph.com/news/crypto-security-tips-social-engineering">isolates unwanted software</a> and prevents hackers from reaching your main device.&nbsp;
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/openai-press-account-hacked-x-shilling-crypto" rel="" target="_self" text="null" title="https://cointelegraph.com/news/openai-press-account-hacked-x-shilling-crypto">OpenAI’s press account hack was 5th security breach in 20 months</a>
<h2 id="what-is-the-xmrig">What is the XMRig?</h2>
The XMRig is a legitimate open-source application that mines the Monero (<a data-ct-non-breakable="null" href="https://cointelegraph.com/xmr-price-index" rel="" target="_self" text="null" title="https://cointelegraph.com/xmr-price-index">XMR</a>) cryptocurrency. However, hackers have integrated the software into their attacks, using various tactics to install the app into different systems since 2020.&nbsp;
In June 2020, a malware called “Lucifer” <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/diabolical-malware-targets-windows-users-to-mine-monero" rel="" target="_self" text="null" title="https://cointelegraph.com/news/diabolical-malware-targets-windows-users-to-mine-monero">targeted old vulnerabilities</a> in Windows systems to install the XMRig mining application.&nbsp;
In August 2020, a malware botnet called “FritzFrog” was <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/monero-cryptojacking-malware-targets-higher-education" rel="" target="_self" text="null" title="https://cointelegraph.com/news/monero-cryptojacking-malware-targets-higher-education">deployed to millions</a> of IP addresses. The malware targeted government offices, educational institutions, banks and companies to install the XMRig app.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/wazirx-exchange-hackers-fake-tether-scams-asia-express/" rel="" target="_self" text="null" title="https://cointelegraph.com/magazine/wazirx-exchange-hackers-fake-tether-scams-asia-express/">Asia Express: WazirX hackers prepped 8 days before attack, swindlers fake fiat for USDT</a>

Email auto-reply vulnerability allows hackers to mine cryptocurrency

Table of Contents

Cointelegraph

Other articles published on Sep 25, 2024

WazirX Hacker ready to vanish with 2000 crores of user funds

Dogecoin (DOGE) Eyes Biggest Price Breakout, But There's a Catch

BitGo Announces USDS Stablecoin Amid WBTC Controversy

Analyst Predicts “Mother Of All Bull Runs” For Ripple (XRP) And This Trending Altcoin

Starknet announces first phase of staking

Bitcoin Sentiment Surges Amid Positive Macroeconomic Factors, Says Standard Chartered Expert, 83 ...

Join our free newsletter for daily crypto updates!