{"id":20364,"date":"2022-11-15T11:54:55","date_gmt":"2022-11-15T16:54:55","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/malicious-cryptominers-2022\/20364\/"},"modified":"2022-11-16T15:24:06","modified_gmt":"2022-11-16T11:24:06","slug":"malicious-cryptominers-2022","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/malicious-cryptominers-2022\/20364\/","title":{"rendered":"Prices down, miners up"},"content":{"rendered":"

We\u2019ve talked a lot lately about cryptocurrencies<\/a>, as well as various scams<\/a> and other crypto-targeting malicious activity<\/a>. Our researchers recently checked out the situation with malicious miners<\/a> \u2014 programs that secretly generate cryptocurrency for their owners using the resources of others folks\u2019 computers. Although malicious miners don\u2019t directly steal data or money, they can make the victim\u2019s life a misery. A device with a miner slows down, heats up, and becomes unusable long before it would normally. What\u2019s more, a miner consumes lots of electricity \u2014 which the affected user of course has to pay for.<\/p>\n

This post lays out our experts\u2019 main findings, and gives tips on how to protect your devices from miners. See our Securelist blog<\/a> for a more detailed report.<\/p>\n

Malicious mining on the rise<\/h2>\n

Having skyrocketed last year, cryptocurrency prices this year have collapsed just as dramatically. One would expect a corresponding drop in malicious mining, but in fact the exact opposite has occurred: in the first three quarters of 2022, compared to the same period in 2021, the number of new miner modifications increased, as did the number of affected users. Cybercriminals were especially active in the third quarter, during which our solutions detected more than 150,000 new variants of malicious miners. For comparison, in the same period in 2021, fewer than 50,000 appeared.<\/p>\n

Our researchers also studied what kinds of malware attackers tried to plant on victims\u2019 devices after exploiting known software vulnerabilities<\/a>. In the first three quarters of 2022, about one in seven cases turned out to be a malicious miner. And throughout the year, as cryptocurrency prices steadily fell, the share of miners among infections showed stable growth. In the third quarter of 2022, this figure already stood at 17 percent (that is, every sixth case), making cryptocurrency miners the second most common malware after ransomware.<\/p>\n

Pirated software \u2014 with miner included<\/h2>\n

Malicious miners, like other malware, spread in a variety of ways. In addition to vulnerabilities, cybercriminals often use pirated content (free movies\/music, hacked software, cracks, cheats, etc.) to deliver such malware. So if, after torrenting a hacked game, your computer suddenly begins to slow down terribly, you may have picked up a miner along the way. And it might not be alone. Not so long ago, for example, our researchers discovered a malicious combo<\/a>: a miner distributed along with a stealer<\/a> (a program that appropriates credentials) under the guise of game cheats and cracks.<\/p>\n

What attackers mine<\/h2>\n

The world is already overflowing with cryptocurrencies. Estimates as to their number vary: Cointelegraph, for instance, claims that there are almost 21,000 of them. Besides Bitcoin and Ethereum, which probably everyone has heard of today, there are cryptocurrencies dedicated to public figures and memes (such as Dogecoin), cryptocurrencies of large companies (such as Binance Coin), government cryptocurrencies (such as the Venezuelan Petro), metaverse cryptocurrencies\u2026 and so the list goes on.<\/p>\n

By studying samples of malicious miners discovered in September 2022, our researchers established what cryptojackers like to mine most of all. Monero (a cryptocurrency focused on anonymity of transactions, making it very difficult, if not impossible, to track them) proved to be the most popular. Bitcoin places second, and Ethereum third. In addition, some of the analyzed samples generated:<\/p>\n