Crypto boom brings malware surge: how USBs are used to hijack devices

There’s a direct correlation between the surge in crypto prices and the likelihood of your devices getting infected with malware.

To obtain cryptocurrency, you can simply go and "dig" for it or, as industry pundits say, mine it.

However, mining doesn’t come without a cost, as you need the right tools for the job. The more computing power you have, the more crypto you can mine.

Mining cryptocurrency is perfectly legal unless you use someone else’s processing power, namely, someone’s laptop, without their consent.

Whenever crypto is on the rise, more tech-savvy individuals are likely to hijack PC resources in hopes of getting rich as quickly as possible. A victim might not suspect their device is infected with crypto mining malware for months, as the only sign might be degraded device performance.

But how do you get infected with that malware? In a recent campaign, it turned out that crooks used USB drives to infect victims’ computers with malware designed to steal Monero, a well-known cryptocurrency often exploited by criminals due to its private nature.

AhnLab Security Intelligence Center (ASEC), which detailed the attack, didn’t provide much information about how victims obtained the infected USB drives. But it’s no coincidence that Monero’s price has risen nearly 48% over the past six months.

While this particular incident involving Monero-mining malware occurred in South Korea, it serves as an important lesson about not trusting any third-party USB drives, regardless of where you are.

“The malware has spread to a large number of unspecified victims through USB propagation and utilizes the CPU and GPU resources of infected systems without authorization to generate continuous profits for the threat actor,” ASEC said.

The attack appears to have been sophisticated, as the malware successfully evaded detection by security solutions.

“The malware actively employed techniques such as C&C communication using the PostgreSQL database, execution bypass using the DLL Sideloading technique, detection evasion through Windows Defender exception settings, and disabling of hibernation to optimize mining performance, successfully evading detection by security solutions.”