As the price of Ethereum and other cryptocurrencies rise, cybercriminals are beginning to create blockchain exploits to invade these digital marketplaces. Many of these threats involve stealing funds directly from mobile wallets and coin exchanges, but some can impact your overall enterprise and endpoint security.

DDoS Attacks, Mobile Wallet Theft and Blockchain Exploits

Perhaps the most devastating incidents have been distributed denial-of-service (DDoS) attacks, either on blockchain-based exchanges or other sources of cryptocurrency. The first such attack targeted the DAO joint Ethereum investment fund back in 2016, but security researchers have reported numerous other DDoS exploits since then.

Another popular blockchain exploit aims to infect mobile wallet apps and online exchanges where cryptocurrency is stored. In recent months, fraudsters have written specialized phishing lures to penetrate these systems.

But wallets aren’t the only sources of digital funds. Last year saw the rise of the initial coin offering, a funding event similar to an initial public offering (IPO), but using new cryptocurrencies that could hold value if the startup gains any traction.

While this sounds very exotic, the method of compromising one offering was fairly old school: Criminals replaced the Ethereum address on the Enigma cryptocurrency investment platform with their own address and collected $500,000 in investment funding for the startup before anyone from the company noticed the change. The replacement was a simple password attack that helped the actors gain access to the Enigma website. Although the money was eventually returned, the cryptocurrency and security communities should expect more of these attacks in 2018.

Mining Malware and Endpoint Security

Fraudsters have also been known to take over unsuspecting endpoint computers and use them to mine or create new crypto coins. Others, meanwhile, have gotten particularly creative in response to the increasing value of these cryptocurrencies. The Neptune exploit kit, for example, enables threat actors to hide their mining payloads in seemingly innocuous hiking advertisements. These tools register the attacker’s email address as the source of the mining operation before infecting the victim’s PC with malware.

Some browser-based malware scripts run in the background even after the user closes his or her browser session. This places the burden on endpoint detection tools to find these infections, which could allow fraudsters to process cycles from corporate PCs.

Mining malware often uses tools favored by other threat actors, such as the EternalBlue exploit, which was used in the WannaCry ransomware outbreak. Take Adylkuzz and CoinMiner, for example. Both use EternalBlue to infect other endpoints once they reach one PC on a network. These mining programs can be very hard to detect because they are often combined with other techniques, such as fileless methods, to hide their tracks.

Finally, NiceHash said it lost about $64 million worth of bitcoin during an attack on its systems in December. The Slovenian bitcoin trading marketplace enables customers to mine for cryptocurrencies by leveraging unused CPU cycles. Although NiceHash is a legitimate mining method, users should exercise extreme caution when using this and similar services.

The Future of Financial Cybercrime

The skyrocketing value of cryptocurrencies has ushered in a new wave of financial cybercrime. These blockchain exploits and mining schemes are growing more sophisticated and more effective every day as investors flock to buy up digital funds. Users should closely monitor their cryptocurrency wallets and implement robust endpoint security measures to protect their increasingly valuable digital funds from this burgeoning threat.

Download the Ransomware Response Guide from IBM Incident Response services

More from Endpoint

The Evolution of Antivirus Software to Face Modern Threats

Over the years, endpoint security has evolved from primitive antivirus software to more sophisticated next-generation platforms employing advanced technology and better endpoint detection and response.  Because of the increased threat that modern cyberattacks pose, experts are exploring more elegant ways of keeping data safe from threats.Signature-Based Antivirus SoftwareSignature-based detection is the use of footprints to identify malware. All programs, applications, software and files have a digital footprint. Buried within their code, these digital footprints or signatures are unique to the respective…

Contain Breaches and Gain Visibility With Microsegmentation

Organizations must grapple with challenges from various market forces. Digital transformation, cloud adoption, hybrid work environments and geopolitical and economic challenges all have a part to play. These forces have especially manifested in more significant security threats to expanding IT attack surfaces. Breach containment is essential, and zero trust security principles can be applied to curtail attacks across IT environments, minimizing business disruption proactively. Microsegmentation has emerged as a viable solution through its continuous visualization of workload and device communications…

Self-Checkout This Discord C2

This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by an attacker to introduce a command and control (C2) channel built upon Discord channel messages. Discord is a chat, voice, and video service enabling users to join and create communities associated with their interests. While Discord and its related software…

3 Reasons to Make EDR Part of Your Incident Response Plan

As threat actors grow in number, the frequency of attacks witnessed globally will continue to rise exponentially. The numerous cases headlining the news today demonstrate that no organization is immune from the risks of a breach. What is an Incident Response Plan? Incident response (IR) refers to an organization’s approach, processes and technologies to detect and respond to cyber breaches. An IR plan specifies how cyberattacks should be identified, contained and remediated. It enables organizations to act quickly and effectively…