Slovak cybersecurity company ESET has discovered a new malware family that has the potential to mine and steal Bitcoin, Ethereum and Monero, as well as exfiltrate cryptocurrency-related files.
Research by ESET reveals a new malware family, known as CryptoCibule, who is able to steal Bitcoin (BTC), mine cryptocurrencies like Ethereum (ETH) y Monero (XMR) and exfiltrate files related to these cryptocurrencies. According to the report, due to the way these malware operate, KryptoCibule represents a triple threat to the security of users and these digital assets.
In detail, KryptoCibule uses the victim's computing resources for cryptocurrency mining, while it can take control over transactions made from an infected device, changing cryptographic addresses to direct funds to an unknown address controlled by the attacker. Likewise, KryptoCibule can exfiltrate or extract files with data and confidential information from devices, all while obfuscating its operations using the network. Tor and the protocol BitTorrent.
El report ESET also reveals that this malware family is written in C# language and uses other legitimately licensed software and servers, such as BitTorrent and Tor, while downloading other servers in the background, such as Apache httpd y SFTP BuruESET also reveals that, despite the fact that this is an undocumented malware family, research indicates that it has been active since 2018 and that several of the malware that comprise it have evolved by adding new and powerful functionalities.
It may interest you: Anubis, the new malware capable of stealing cryptocurrency wallet credentials
How does KryptoCibule work?
«KryptoCibule has three components that leverage infected hosts to obtain cryptocurrency: cryptomining, clipboard hijacking, and file exfiltration.»
To infect devices, KryptoCibule spreads via malicious torrents for ZIP files, which appear to be installers for pirated software and games, but when executed, they decrypt the expected installation files along with the malware. Once installed, KryptoCibule begins operating on the infected device without warning the victim that something is amiss.
First, KryptoCibule hijacks cryptocurrency wallet applications to swap addresses and redirect funds to a hacker-controlled wallet via the AddClipboardFormatListener. Researchers point out that this method or component is the most exploited to get as much money as possible from victims. Secondly, KryptoCibule hijacks and uses the computational power of the infected CPU or GPU to mine cryptocurrencies, such as Monero (XMR) and Ethereum (ETH), respectively. This activity, known as cryptojacking, allows hackers to connect to a mining server controlled by them from the infected device, to benefit from the funds and rewards obtained from mining.
Finally, the malware has the potential to crawl through all data and files to identify and extract any cryptocurrency-related information of interest, such as passwords, among others. Also, according to the researchers, when KryptoCibule is first run, a unique identifier is assigned to the host, which allows the host to be recognized within communications with command and control servers. The format of this identifier allows for taking random words that provide more than 10 million combinations, making it quite difficult to identify where the orders are being given to the computers infected with the malware.
According to the report, the majority of victims, around 85% of all attacks, are located in Slovakia and the Czech Republic. These countries are the target of hackers running this malware because most of the malicious torrents were hosted on the digital portal. save it, one of the most popular file sharing sites in these European countries.
About ESET
ESET is a company with a long history and experience that provides computer security solutions in more than 200 countries around the world. The company is the creator of the renowned antivirus software ESET NOD32, one of its most famous and acclaimed products.
ESET security solutions are aimed at businesses and corporations as well as ordinary users. ESET offers innovative, high-performance and easy-to-use products to ensure the protection and security of information, both on mobile devices and on computers, terminals, and many others. ESET security products are constantly evolving to provide effective and real-time security solutions for all its customers and users.
Continue reading: Lazarus Group targets cryptocurrency theft with phishing attacks
