Recent Advances in Cryptovirology: State-of-the-Art Crypto Mining and Crypto Ransomware Attacks

Abstract

Recently, ransomware has earned itself an infamous reputation as a force to reckon with in the cybercrime landscape. However, cybercriminals are adopting other unconventional means to seamlessly attain proceeds of cybercrime with little effort. Cybercriminals are now acquiring cryptocurrencies directly from benign Internet users without the need to extort a ransom from them, as is the case with ransomware. This paper investigates advances in the cryptovirology landscape by examining the state-of-the-art cryptoviral attacks. In our approach, we perform digital autopsy on the malware's source code and execute the different malware variants in a contained sandbox to deduce static and dynamic properties respectively. We examine three cryptoviral attack structures: browser-based crypto mining, memory resident crypto mining and cryptoviral extortion. These attack structures leave a trail of digital forensics evidence when the malware interacts with the file system and generates noise in form of network traffic when communicating with the C2 servers and crypto mining pools. The digital forensics evidence, which essentially are IOCs include network artifacts such as C2 server domains, IPs and cryptographic hash values of the downloaded files apart from the malware hash values. Such evidence can be used as seed into intrusion detection systems for mitigation purposes.

Illuminating the dark corners: a qualitative examination of cryptocurrency’s risk

“…Due to its anonymity and difficulty in being tracked, cryptocurrencies like Bitcoin have become more and more in demand by ransomware attackers in recent years (Alqahtani and Sheldon, 2022). Receiving payments in Bitcoins is quite simple for the attackers since they simply need to supply a Bitcoin wallet address (Zimba et al , 2019). A recent example of a ransomware attack on All India Institute of Medical Sciences computer systems demanded Rs 200 crore in cryptocurrency to restore data.…”

Comprehensive Analysis to Detect Mobile Malware Using Multiple Techniques

“…The victim receives access codes to unlock their mobile device once they pay the ransom. Attackers can generate bitcoin by surreptitiously carrying out calculations on a victim's device through the use of cryptomining malware [2]. Trojan code, which is concealed in apps that appear authentic, is frequently used for cryptocurrency mining.…”