Phishing scams and hidden mining Trojans are making a comeback, don’t become hackers’ mining machines and cash machines

When you are playing "Grand Theft Auto 5" comfortably on your computer, can you imagine that your computer is being controlled by a Trojan horse program at this time, for a technology company thousands of miles away"mining", earn cryptocurrency for them?

When you are browsing the web, do you notice the advertisement page that pops up on the website——"Musk's crypto airdrop", can you imagine that if you click on the advertisement, the cryptocurrency assets in your wallet may be stolen in an instant?

No, it's not fantasy, it's real, the former is called"Hidden Mining Trojan", the latter is called"secondary title"。

The Prevalence of Hidden Mining Trojans

In 2018, Chinese public security organs cracked a mining Trojan case involving millions of computers.

The game "PlayerUnknown's Battlegrounds", commonly known as "Eating Chicken", has become popular on the Internet and has become the favorite of many gamers. In order to be "invincible" in the game, many players use the game's plug-in program to have more capabilities, such as "automatic aiming", "see-through", "bullet acceleration", etc. Most of the plug-ins claim to be free, but the memory is tricky .

On December 20, the security team of the Tencent Guardian Project discovered a Trojan horse program hidden in a plug-in called "Chicken Eater" in the game "PUBG Mobile", which has the function of background silent mining. Preliminary statistics of the Trojan horse program Infect hundreds of thousands of user machines.

Subsequently, the clues were transferred to the Internet Security Detachment of Weifang Public Security Bureau for investigation. After continuous investigation by the public security organs,"Mining Trojan"Behind it is a regular Internet company.

The cause of the incident is that since 2014, the mainstream cryptocurrency represented by Bitcoin has become popular, resulting in the emergence of many cryptocurrencies. After seeing this "outlet", since 2015, Dalian Shengping Network Technology Co., Ltd. has been recruiting agents all over the country to promote software clients bundled with mining Trojan horses. Once the client is implanted in the computer host, it will silently download The mining monitoring software and mining program are running, and the mined coins will be transferred to the cryptocurrency wallet of the company controller He Mou.

He explained:

"Once the host is implanted with a Trojan horse, as long as the host is turned on, its monitoring software will analyze the utilization rate of the computer's CPU. Once it is lower than 50%, it will start the 'mining' program for 'mining'. If the CPU utilization rate is high Just stop 'mining' to prevent being discovered."

According to statistics, since 2015, He and others have illegally controlled 3.89 million computer hosts to advertise value-added income, silently installed mining programs on more than 1 million computer hosts, and mined a total of DGB coins ("Gigitecoin") in the past three years. ), DCR coins ("Desay coins"), and SC coins ("Cloud coins") were more than 26 million pieces, with a total illegal profit of more than 15 million yuan.

secondary title

Hidden Mining Trojans Flood Again

Not long ago, the Internet security company Avast released the latest research report stating that as many as eleven well-known pirated games have been detected, hiding malicious mining software that can steal computer resources. Once the user downloads and installs these free pirated game software distributed by forums and unofficial platforms without knowing it, the device will be automatically implanted with a malicious software launcher called "Crackonosh", which will exploit the user's The computer computing resources are used to mine the encrypted currency "Monero" (Monero) behind the scenes. Not only can it cleverly bypass the detection and interception of security antivirus software, but it can also make computer devices run slower and slower, and even users have to pay huge electricity bills for this.

So far, according to the detection of Avast researchers, in the past six months, a total of more than 12 countries and about 220,000 Windows PCs around the world have been infected by Crackonosh malware.

Taking this May as an example, an average of thousands of computer devices were still compromised every day. The value of Monero coins generated by cumulative mining is estimated to be as high as 2 million US dollars (approximately RMB 12.91 million). The countries and regions affected by this wave are mainly concentrated in North America, Brazil, India, the Philippines, and Germany, etc., especially in Brazil, India, and the Philippines, where the malicious infection of PC user devices is the most serious.

secondary title

Embers of Phishing Scams Revive

Since the beginning of the year, Avast's Threat Lab researchers have intercepted and protected users from an increase in crypto-related phishing sites, most of which pose as legitimate hosted wallets. The rise of these sites is higher in countries where cryptocurrency adoption is most widespread. The US, Brazil, and Nigeria are the biggest targets of these crypto scams, with the UK, France, Russia, and India also seeing high levels of scams. For this study, Avast Threat Labs monitored 37 samples. The global heatmap below shows the location of user access encryption-related phishing around the world in the first six months of 2021:

Peter Kovac, a senior researcher at Avast, said: “The crypto market is booming right now. Bitcoin got a boost after the recent news in El Salvador that it will be recognized as legal tender in the country — and other countries in the region are following suit. Emulate."

secondary title

How to avoid being someone else's"miner"And a cash machine for hackers?

First of all, the best way to prevent hidden mining Trojans is to avoid it completely by downloading games and other software only from official websites and stores. Users are advised to be aware of illegal sources offering free premium games and avoid unofficial suppliers.

Try not to click on some unknown links and files on the Internet; try not to connect to unknown networks and U disks casually; try some special software such as MinerBlock, anti-webminer and Adblock Plus, which can prevent the invasion of mining viruses. In addition, it is also very effective to regularly back up the computer to reduce losses after various viruses in the computer.

The early mining Trojan horses did not limit the consumption of system resources. When the mining Trojan horse was running, the resource consumption of the computer would increase, the CPU usage would increase significantly, the computer would become hot, and the running speed would slow down. These obvious symptoms make early mining Trojans easier to be discovered and removed by users. After evolution, the mining Trojan has adjusted its mining behavior in order to avoid being discovered by users. When it detects that the CPU usage on the user's computer is high, it will automatically suspend mining. When the user's computer is idle, it will fully mine. In this way, the evolved mining Trojan can survive on the user's computer for a longer period of time, making it difficult to find any abnormalities even if your computer is already poisoned. In this case, you can only rely on anti-virus software to check, alarm, and clear.

If you can obviously feel that the computer is slow, you should check the CPU usage immediately. If you find suspicious processes, you can close them in time and check whether there are suspected unknown public key files. (such as /tmp/ddg/tmp/AnXq, /tmp/AnXqV)

Avast reminds users that phishing scams can come in many forms online, from "Elon Musk's crypto giveaway" to "we'll invest in you and earn XYZ% every month." If that sounds too good to be true, then it probably is.

Encryption owners should:

• Watch out for unsolicited private messages: Whether on WhatsApp/Telegram or any other social media forum, people should immediately block any unsolicited messages that may be fraudulent. For example, if a message comes from an unknown number, or if it comes from a contact but is an unusual and possibly urgent message from that contact, that contact's phone may have been hacked. It is advisable to get in touch with the contact, for example by phone, and verify that they actually sent this message before taking any further action. Even if the message has nothing to do with encryption, the intent may be phishing, which ends up spying on the user's data.

• Watch out for mobile phishing: Hackers are increasingly targeting mobile devices to steal encryption credentials. These attacks can come from anywhere on a mobile device, including text, social media, third-party messaging platforms, or email. In addition to phishing, there is also a rise in malicious mobile apps with hidden features that log keystrokes and monitor people's on-screen activity. To prevent mobile phishing attacks, users can use some web security software that provides anti-phishing features that can block dangerous websites on Android devices. The browser's anti-phishing feature also works on Windows and Mac devices.

• Rely on services that use strong security measures: When choosing a custodial or software wallet, one should make sure that people choose a provider that offers strong security measures, including two-factor authentication methods. In order to be more secure, some platforms encourage users to set a separate password to log in to the platform and transfer money. People who want complete privacy might choose a platform that doesn't require them to submit an ID, but these platforms often offer poor security measures. Some platforms can offer this because they only allow transactions in cryptocurrencies and not in fiat currencies like EUR or USD, which is why they are not obligated to comply with AML and Know Your Customer (KYC) rules.

• Install antivirus software: Cryptocurrency owners should ensure that all their devices have strong antivirus protection. For example, many people have antivirus software installed on their PCs, but not on their mobile devices or tablets -- which is why malicious mobile phishing and malware campaigns are so effective against hackers. Encrypted accounts can be valuable, so it's critical for users to ensure strong internet security on any device that stores encrypted information or accesses accounts.