Threat Management, Threat Management, Malware

Free software downloads infecting users with NiceHash cryptominer, warns researchers

December 21, 2017

Adversaries are using the lure of free online software downloads to infect unknowing victims with a customized version of cryptocurrency mining software from the NiceHash marketplace.

In a Dec. 21 Securelist blog post, Kaspersky Lab reports detecting 16 websites with Russian .ru top-level domains that offer free (or seemingly free) applications or software packages, including such titles as OpenOffice, Adobe Premiere Pro, CorelDraw, and PowerPoint. Approximately 200 of these various files were determined to secretly include the cryptominer as a component.

An analysis of one of these files, presented as a full version of ABBYY FineReader, determined that its folders contained not only the NiceHash miner itself, but also text files containing wallet details and the mining pool's address. It also contained a BAT script, compiled into a PE file named "system.exe," which initializes the miner's operation and retrieves a PowerShell script that assigns an ID to the infected computers and launches the actual mining operations. In this instance, zcash was the targeted cryptocurrency.

"The mining software that we analyzed, albeit incapable of inflicting any damage, can seriously impair your workstation's performance by hijacking its resources and making it work for somebody else," warns Kolesnikov in the blog post.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

United States Department of the Treasury seal

Identity

BeyondTrust breach hits US Treasury Department

SC StaffDecember 31, 2024

The U.S. Treasury Department was confirmed to have its computers and documents compromised by Chinese state-backed advanced persistent threat hackers in an attack targeted at its BeyondTrust Remote Support software-as-a-service instance just over a week after the BeyondTrust breach was initially reported, reports BleepingComputer.

China Flag Made of Binary Code and Chinese Symbols on Red Backgr

Critical Infrastructure Security

Another US telco breached by Salt Typhoon as AT&T, Verizon acknowledge compromise

SC StaffDecember 30, 2024

Nine U.S. telecommunications firms were confirmed by U.S. officials to have been compromised by Chinese state-backed threat group Salt Typhoon as part of its sweeping cyberespionage operation, with the newly-added unnamed entity's networks breached to facilitate geolocating activities for millions of individuals, Reuters reports.

Russia flag is depicted on the screen with the program code. The concept of modern technology and site development.

Critical Infrastructure Security

Italian websites subjected to pro-Russian DDoS attack campaign

SC StaffDecember 30, 2024

Security Affairs reports that numerous Italian websites — including those of the country's Ministry of Foreign Affairs, the Turin Transport Group, and the Linate and Malpensa airports — have been compromised as part of a distributed denial-of-service attack by pro-Russian hacktivist operation NoName057, which noted the intrusions to have been launched in retaliation of "Italian Russophobes."

Related Events

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news