January 8, 2018 By David Strom 2 min read

As the price of Ethereum and other cryptocurrencies rise, cybercriminals are beginning to create blockchain exploits to invade these digital marketplaces. Many of these threats involve stealing funds directly from mobile wallets and coin exchanges, but some can impact your overall enterprise and endpoint security.

DDoS Attacks, Mobile Wallet Theft and Blockchain Exploits

Perhaps the most devastating incidents have been distributed denial-of-service (DDoS) attacks, either on blockchain-based exchanges or other sources of cryptocurrency. The first such attack targeted the DAO joint Ethereum investment fund back in 2016, but security researchers have reported numerous other DDoS exploits since then.

Another popular blockchain exploit aims to infect mobile wallet apps and online exchanges where cryptocurrency is stored. In recent months, fraudsters have written specialized phishing lures to penetrate these systems.

But wallets aren’t the only sources of digital funds. Last year saw the rise of the initial coin offering, a funding event similar to an initial public offering (IPO), but using new cryptocurrencies that could hold value if the startup gains any traction.

While this sounds very exotic, the method of compromising one offering was fairly old school: Criminals replaced the Ethereum address on the Enigma cryptocurrency investment platform with their own address and collected $500,000 in investment funding for the startup before anyone from the company noticed the change. The replacement was a simple password attack that helped the actors gain access to the Enigma website. Although the money was eventually returned, the cryptocurrency and security communities should expect more of these attacks in 2018.

Mining Malware and Endpoint Security

Fraudsters have also been known to take over unsuspecting endpoint computers and use them to mine or create new crypto coins. Others, meanwhile, have gotten particularly creative in response to the increasing value of these cryptocurrencies. The Neptune exploit kit, for example, enables threat actors to hide their mining payloads in seemingly innocuous hiking advertisements. These tools register the attacker’s email address as the source of the mining operation before infecting the victim’s PC with malware.

Some browser-based malware scripts run in the background even after the user closes his or her browser session. This places the burden on endpoint detection tools to find these infections, which could allow fraudsters to process cycles from corporate PCs.

Mining malware often uses tools favored by other threat actors, such as the EternalBlue exploit, which was used in the WannaCry ransomware outbreak. Take Adylkuzz and CoinMiner, for example. Both use EternalBlue to infect other endpoints once they reach one PC on a network. These mining programs can be very hard to detect because they are often combined with other techniques, such as fileless methods, to hide their tracks.

Finally, NiceHash said it lost about $64 million worth of bitcoin during an attack on its systems in December. The Slovenian bitcoin trading marketplace enables customers to mine for cryptocurrencies by leveraging unused CPU cycles. Although NiceHash is a legitimate mining method, users should exercise extreme caution when using this and similar services.

The Future of Financial Cybercrime

The skyrocketing value of cryptocurrencies has ushered in a new wave of financial cybercrime. These blockchain exploits and mining schemes are growing more sophisticated and more effective every day as investors flock to buy up digital funds. Users should closely monitor their cryptocurrency wallets and implement robust endpoint security measures to protect their increasingly valuable digital funds from this burgeoning threat.

Download the Ransomware Response Guide from IBM Incident Response services

More from Fraud Protection

Unveiling the latest banking trojan threats in LATAM

9 min read - This post was made possible through the research contributions of Amir Gendler.In our most recent research in the Latin American (LATAM) region, we at IBM Security Lab have observed a surge in campaigns linked with malicious Chrome extensions. These campaigns primarily target Latin America, with a particular emphasis on its financial institutions.In this blog post, we’ll shed light on the group responsible for disseminating this campaign. We’ll delve into the method of web injects and Man in the Browser, and…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today