Network Communication With Crypto Mining Pools

This threat involves the unauthorized use of compromised systems for cryptocurrency mining, a practice known as cryptojacking. Unspecified threat actors deploy specialized malware that hijacks a victim's computing resources (CPU, GPU) to mine cryptocurrencies such as Monero. The malware then communicates with public or private mining pools to contribute its processing power and receive payouts, often anonymously. This activity significantly degrades system performance, increases power consumption, and can lead to hardware wear, resulting in operational disruption and financial costs for the victim organization. The detection focuses on identifying the characteristic network connections to known crypto mining pool domains, indicating an active infection.

Attack Chain

1. Initial Access: Threat actors gain unauthorized access to a victim's system or network through various means, such as exploiting vulnerabilities, delivering malicious payloads via phishing campaigns, or bundling malware with legitimate software.
2. Malware Delivery and Installation: The crypto mining malware is delivered to the compromised system and installed, often masquerading as a benign application or service to avoid detection.
3. Persistence Establishment: The malware establishes persistence mechanisms, such as modifying registry run keys, creating scheduled tasks, or adding itself to startup folders, to ensure continuous operation across system reboots.
4. Resource Assessment: Upon execution, the mining software often performs an initial assessment of the system's available computing resources (CPU, GPU, memory) to optimize its mining operations and avoid immediate detection by overwhelming the system.
5. Mining Process Initiation: The crypto miner process starts, allocating a significant portion of the system's CPU and/or GPU cycles to perform cryptographic computations required for mining.
6. Network Communication to Pool: The miner establishes an outbound network connection to a pre-configured or hardcoded cryptocurrency mining pool domain to receive mining tasks and submit completed work.
7. Data Exchange and Payout: The miner continuously exchanges data with the mining pool, submitting cryptographic proof-of-work and receiving new blocks or tasks, with the objective of receiving cryptocurrency rewards for the attacker.
8. Resource Hijacking Impact: Prolonged and unauthorized mining operations lead to severe system performance degradation, increased electricity bills, and potential hardware overheating or damage, disrupting normal business operations.

Impact

Successful cryptojacking attacks result in substantial resource consumption on compromised systems, leading to noticeable performance degradation, increased electricity usage, and accelerated wear and tear on hardware components. While the primary financial gain is for the attacker, organizations bear the cost of increased operational expenses and potential system downtime. The broad targeting nature of this threat means any organization with vulnerable internet-facing assets or endpoints susceptible to malware delivery could be affected, leading to widespread impact on productivity and infrastructure stability across various sectors.

Recommendation

• Deploy the provided Sigma rule "Network Communication With Crypto Mining Pool" to your SIEM or EDR solution to detect outbound connections to known mining pools.
• Block all domains listed in the IOC table at your network perimeter firewall or DNS resolver to prevent miner communication.
• Monitor network connection logs from Windows endpoints for unusual outbound connections, specifically targeting the DestinationHostname field.
• Regularly patch and update all operating systems and software to prevent initial access via known vulnerabilities.