Youtube is normally a place where content creators want to be as visible as possible, but the Stantinko botnet has been using the online video service as a place to hide malware for cryptocurrency attacks.

Attackers are using proxies to facilitate communication between a cryptominer and command-and-control (C&C) servers by embedding the IP addresses within the description text of YouTube videos, according to ESET.

Although YouTube has since removed the videos and channels on which they were being run, researchers said the Stantinko botnet was primarily using them to mine the Monero cryptocurrency.

How YouTube Became a Cryptomining Hideout

Once communication with a mining proxy has been established, Stantinko downloads the code for a hashing algorithm, which researchers said allows cybercriminals to make adjustments and mine for more profitable cryptocurrencies based on valuations at the time of an attack.

Though the malware has been identified as Win{32,64}/CodeMiner.Stantinko, researchers said attackers have been careful to obfuscate certain strings and remove functionality to make it more difficult to detect. Most security products would easily detect such algorithms, the researchers added, but in this case, the cybercriminals are working harder to hide their tracks. For example, the malicious code is never stored on disk because the core part of the module is being downloaded from a remote server.

When the cryptominer is running successfully, researchers said it can also detect the use of security products and suspend rival cryptomining applications if there are any on a victim’s machine. If a victim is using their task manager or running on battery power, meanwhile, the cryptominer can stop itself to avoid any signs of its activities.

The Stantinko botnet is by no means a new threat, having been in operation since at least 2012. A few years ago, researchers estimated it had infected more than half a million systems.

How to Stop Stantinko From Spreading

Earlier this year, IBM X-Force research suggested malware-based cryptomining attacks may be on the rise. That means organizations should arm themselves with a robust risk assessment program and educate all the right stakeholders — including those who might innocently be browsing YouTube on their personal time and not realize the risks hidden within video descriptors.

More from

The Evolution of Antivirus Software to Face Modern Threats

Over the years, endpoint security has evolved from primitive antivirus software to more sophisticated next-generation platforms employing advanced technology and better endpoint detection and response.  Because of the increased threat that modern cyberattacks pose, experts are exploring more elegant ways of keeping data safe from threats.Signature-Based Antivirus SoftwareSignature-based detection is the use of footprints to identify malware. All programs, applications, software and files have a digital footprint. Buried within their code, these digital footprints or signatures are unique to the respective…

How Do Threat Hunters Keep Organizations Safe?

Neil Wyler started his job amid an ongoing cyberattack. As a threat hunter, he helped his client discover that millions of records had been stolen over four months. Even though his client used sophisticated tools, its threat-hunting technology did not detect the attack because the transactions looked normal. But with Wyler’s expertise, he was able to realize that data was leaving the environment as well as entering the system. His efforts saved the company from suffering even more damage and…

The White House on Quantum Encryption and IoT Labels

A recent White House Fact Sheet outlined the current and future U.S. cybersecurity priorities. While most of the topics covered were in line with expectations, others drew more attention. The emphasis on critical infrastructure protection is clearly a top national priority. However, the plan is to create a labeling system for IoT devices, identifying the ones with the highest cybersecurity standards. Few expected that news. The topic of quantum-resistant encryption reveals that such concerns may become a reality sooner than…

Contain Breaches and Gain Visibility With Microsegmentation

Organizations must grapple with challenges from various market forces. Digital transformation, cloud adoption, hybrid work environments and geopolitical and economic challenges all have a part to play. These forces have especially manifested in more significant security threats to expanding IT attack surfaces. Breach containment is essential, and zero trust security principles can be applied to curtail attacks across IT environments, minimizing business disruption proactively. Microsegmentation has emerged as a viable solution through its continuous visualization of workload and device communications…