In early 2018, many security companies and independent experts warned about the emergence of a mining botnet that used infected hosts to mine the Monero cryptocurrency. According to experts, the number of infected computers reached between 500,000 and 1,000,000, and the malware operators “earned” about 8,900 Monero (roughly 2 million dollars at the exchange rate in effect at the time).
This malware was named WannaMine, and the threat was identified by specialists at CrowdStrike. Of course, the parallel with WannaCry is no accident. The fact is that to spread the malicious programs, they used the EternalBlue (CVE-2017-0144) and EsteemAudit (CVE-2017-0176) exploits, which target vulnerable Windows computers. The names of these exploits are well known not only to information security professionals but even to ordinary users, since it was EternalBlue that was used in the spring of 2017 to spread the WannaCry ransomware, which made headlines worldwide.
Let me remind you that in the summer of 2016, a group of hackers calling themselves The Shadow Brokers managed to steal hacking tools from NSA specialists. For a long time, the hackers tried in vain to sell the “cyber weapon” in their hands, but they failed to organize an auction or find a direct buyer. Afterward, in April 2017, the group published the stolen data for free, into the public domain.
These ready-made tools from the NSA’s arsenal (or rather, the EternalBlue and DoublePulsar exploits) were used by the creators of WannaCry. In addition, exploits from intelligence services were adopted by the creators of NotPetya, another mining malware, Adylkuzz, and others.
Microsoft patched the aforementioned vulnerabilities, which used tools stolen from the NSA, and prepared fixes for obsolete and unsupported operating systems, notably Windows XP, Windows 8 and Windows Server 2003. However, even a year later, many companies and users still did not bother to apply the fixes.
Analysts at Cybereason warned that WannaMine malware was still active and was infecting the networks of large companies. Thus, experts said that the other day, a mining virus attacked one of their clients, a large company whose branches around the world were on the Fortune 500 list. After infiltrating a vulnerable machine, the malicious program spread to more than 1,000 systems in a single day. As a result, dozens of domain controllers and about 2,000 endpoints were infected.
Researchers write that WannaMine attacks are almost fileless. Thus, the PowerShell script is loaded from a remote server, which helps the malware gain a foothold in the system. In addition, a large file containing base64 text is loaded from the management server. It is worth noting that the payload due to obfuscation is so enormous that it is almost impossible to open it in a text editor.
This file also contains PowerShell code, including the PowerShell version of the Mimikatz tool, as well as a huge binary blob used to work with the PingCastle tool and search for other vulnerable hosts. The collected credentials and network information are used to penetrate available machines and infect them. The malicious DLL is assigned a random name, different for each infected system.
At the same time, experts at Cybereason note that WannaMine still uses the same servers previously seen in malicious operations. The experts tried to contact the owners of the hosting providers for the detected addresses, but received no response.
