Youtube is normally a place where content creators want to be as visible as possible, but the Stantinko botnet has been using the online video service as a place to hide malware for cryptocurrency attacks.
Attackers are using proxies to facilitate communication between a cryptominer and command-and-control (C&C) servers by embedding the IP addresses within the description text of YouTube videos, according to ESET.
Although YouTube has since removed the videos and channels on which they were being run, researchers said the Stantinko botnet was primarily using them to mine the Monero cryptocurrency.
How YouTube Became a Cryptomining Hideout
Once communication with a mining proxy has been established, Stantinko downloads the code for a hashing algorithm, which researchers said allows cybercriminals to make adjustments and mine for more profitable cryptocurrencies based on valuations at the time of an attack.
Though the malware has been identified as Win{32,64}/CodeMiner.Stantinko, researchers said attackers have been careful to obfuscate certain strings and remove functionality to make it more difficult to detect. Most security products would easily detect such algorithms, the researchers added, but in this case, the cybercriminals are working harder to hide their tracks. For example, the malicious code is never stored on disk because the core part of the module is being downloaded from a remote server.
When the cryptominer is running successfully, researchers said it can also detect the use of security products and suspend rival cryptomining applications if there are any on a victim’s machine. If a victim is using their task manager or running on battery power, meanwhile, the cryptominer can stop itself to avoid any signs of its activities.
The Stantinko botnet is by no means a new threat, having been in operation since at least 2012. A few years ago, researchers estimated it had infected more than half a million systems.
How to Stop Stantinko From Spreading
Earlier this year, IBM X-Force research suggested malware-based cryptomining attacks may be on the rise. That means organizations should arm themselves with a robust risk assessment program and educate all the right stakeholders — including those who might innocently be browsing YouTube on their personal time and not realize the risks hidden within video descriptors.