316K Victims of Smominru Cryptocurrency Mining Botnet

Beginning in August of 2017, a new cryptocurrency mining botnet, dubbed Smominru, started propagating via the recently leaked Eternal Blue exploit. Smominru, aka MyKings, is characterized by the targeting of Windows systems using WMI as a file-less persistence mechanism.[1]

As of March 2019, Smominru showed no signs of slowing down.  Wapack Labs has identified approximately 316K victims connecting to Smominru infrastructure over a period of 6 days.  This report provides a high-level overview of the malware installation as well as details on the Smominru infrastructure and botnet.

To read the full article and find an archive of related reporting, follow this link to READBOARD.

WWW.WAPACKLABS.COM

Asian Bitcoin Exchanges as Potential Hacker Targets

North Korea has been identified as conducting multiple thefts of Bitcoin cryptocurrency in 2017. These thefts have involved spearphishing attacks against at least two Bitcoin exchanges in South Korea that resulted in compromises of their systems and the loss of millions of dollars in Bitcoin. This appears to be part of a major North Korean campaign to acquire Bitcoin as a way to raise hard currency. This campaign was active through at least, December 2017. Given the North Korean interest in Bitcoin and the success of their hacker efforts to date, other cryptocurrency exchanges in the region may also be at risk. As a guide to further monitoring of this situation, a listing of exchanges in South Korea and Japan was compiled. The Japanese list consists of those recently certified by the Japanese government and one that is still awaiting certification...READ MORE

Wapack Labs has cataloged and reported on cryptocurrency related targeting in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

North Korea’s Illegal Campaign to Acquire Bitcoin

North Korea has been identified as conducting multiple thefts of Bitcoin cryptocurrency in 2017. In conjunction with its identification as the actor behind the Wannacry ransomware, which was also an attempt to acquire Bitcoin, plus limited evidence of bitcoin mining, these actions indicate a major North Korean campaign is underway to acquire Bitcoin as a way to raise hard currency. North Korea was likely motivated to acquire Bitcoin, by any means, because of the currency’s rapidly increasing value in 2017, the possibility of hiding the thefts by converting Bitcoin into more obscure forms of cryptocurrency, and the convertibility of Bitcoin and these other cryptocurrencies to hard currency. While it is unusual for a nation-state to be involved in this type of theft, it is not much different from other North Korean criminal enterprises which have included cyber bank robbery, illegal weapons sales, and counterfeiting U.S. currency...READ MORE

Wapack Labs has cataloged and reported on North Korean cyber activity in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Browser-Side JavaScript Miners Affect Computer Performance

Browser-side mining of cryptocurrencies, which uses parallel processing CPU power for profit, was developed in the 2011-2014 time-frame. In September 2017, it was distinguished as part of malicious campaigns. Some content providers test this technology as a way to monetize their traffic. The SafeBrowse Chrome extension was allegedly hacked to include a mining functionality. These mining scripts pose a moderate cyber threat, as they significantly slow down the computer while the page is open in the browser. Detecting these malvertising campaigns and disabling mining scripts is advised...READ MORE

Wapack Labs has cataloged and reported extensively on mining cryptocurrencies in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Adopting Maritime Cryptocurrency Requires Due Diligence and Caution

The New “maritime cryptocurrency” – the TEU (the maritime Twenty-foot Equivalent Unit) tokens on Ethereum, were recently announced. The promotors, ETH Smart Contract Tech Limited, started a fundraising token sale on 16 August 2017. It is issued by 300cubits; a startup out of Hong Kong, China. Blockchain is being tested in different fields, from financing to transportation. But this new technology poses many risks, to include: programming mistakes on many levels; backup requirements; built-in irreversibility and so-called 51% attacks that may reverse transactions; intentional fraudulent token fundraising and poorly designed business models; price volatility; legal complications and changes to laws; and hacking incidents. The TEU tokens specifically share many of these risks, some of which are mentioned in the TEU terms, and some which are not. Nevertheless, the TEU partial adoption cannot be completely ruled out as of this writing...READ MORE

Wapack Labs has cataloged and reported extensively on cryptocurrency and maritime security issues in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Russia is Considering Ethereum's Blockchain Technology

Russian president, Vladimir Putin, recently met with Ethereum Cryptocurrency founder, Vitalik Buterin. Russia, in the past, has effectively banned Bitcoin use by its companies and is now likely switching to "use and control" emerging Blockchain technologies. Bitcoin is the original blockchain-based cryptocurrency and has become very popular in black markets, including online drug sales and cybercrime. Ether (token for Ethereum), is one of the alternatives growing fast in general popularity. Besides the currency function, Ethereum provides much more functionality: it is an open-source, public, blockchain-based distributed computing platform that features smart contact (scripting) functionality, which facilitates online contractual agreements. This makes Ethereum technologies of interest for major financial institutions and IT companies. Blockchain technologies are not bad per se, and many Western financial institutions are attracted to its use, but Russia's history of protecting black-hat hackers and controlling some online black markets make this development worrisome...READ MORE

Wapack Labs has cataloged and reported extensively on Russia, blockchains, and cryptocurrency in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Transfer Money Anonymously with Russian Cryptocheck

Cryptocheck (Cc) is a dubious Russian based payment system discovered in recent collections. Cc heralds a safe and anonymous way to transfer money online. Cc combines electronic vouchers, traditional payment systems and cryptocurrency. This payment service is used in many Russian speaking forums; however, Cc has also been found in a number of English speaking forums. Cc promoted their service as a combination of all the best cyber payment systems that exist using cryptocurrency. Personal user data is not requested or used in Cc. Cc provides payments with unique check and code numbers. The check number can have 58^6 combinations and the code number consists of 58^9 possible combinations, offering anonymity.

Wapack Labs has cataloged and reported extensively on payment services in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM