New Crypto-Mining Malware Targeting Asian Firms With NSA Tools

A new form of malware is targeting enterprises in Asia to mine monero (XMR) cryptocurrency.

Cybersecurity software provider Symantec published the news in a blog post Wednesday, saying that over 80 percent of victims are located in China, with nations such as South Korea, Japan and Vietnam also seeing activity.

Dubbed "Beapy," the malicious code is a file-based crypto miner, not a browser-based one, the firm said. It works by sending a malicious Excel file to victims as an email attachment, downloading the DoublePulsar backdoor onto the victim’s system if the file is opened.

DoublePulsar (notably developed by the U.S. National Security Agency before it was stolen then released to the public in 2017) was also used in the WannaCry ransomware attack in 2017, according to the post.

Once DoublePulsar is installed on to a victim’s machine, the miner is downloaded. At the same time, it uses another leaked NSA tool, EternalBlue, to propagate across the infected network via unpatched computers where it can steal credentials to further access patched machines.

Cryptojacking malware can have a major impact on enterprises, Symantec said, including slowing down device performance, reducing employee productivity and increasing costs.

Although cryptojacking activity has decreased by about 52 percent over the last year, it is still an area of interest among hackers which largely target businesses.

Symantec said:

The firm said it first noticed Beapy in January of this year, but activity has increased since early March.

Monero's privacy features make it by far the most popular cryptocurrency among hackers deploying mining malware. A recent academic study estimated that cybercriminals have mined around 5 percent of the total monero in circulation.

Earlier this year, researchers at cybersecurity firm Palo Alto Networks discovered a form of malware that takes administrative control to first uninstall cloud security products and then injects code to mine monero. The same team also discovered another variant that steals browser cookies and other information on Apple Mac computers to directly steal cryptocurrencies.

Symantec image via Shutterstock