{"id":2437,"date":"2024-09-25T18:07:18","date_gmt":"2024-09-25T18:07:18","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2437"},"modified":"2025-07-29T03:42:40","modified_gmt":"2025-07-29T03:42:40","slug":"attackers-enslave-cpu-resources-set-them-to-cryptocurrency-mining","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/attackers-enslave-cpu-resources-set-them-to-cryptocurrency-mining\/","title":{"rendered":"Attackers enslave CPU resources, set them to cryptocurrency mining"},"content":{"rendered":"
\n
\"Rudnik_Velenje\"<\/figure>\n<\/div>\n\n\n

Most cyberattackers target the personal data or pocketbooks of their victims, but others are after something else entirely \u2013 processing power. 

This was the case when we witnessed a spike in a customer\u2019s CPU usage. The customer, who\u2019s environment contained predominately Linux machines, reported nothing out of the ordinary. Our analysis quickly uncovered the culprit \u2013 a Monero <\/a>cryptocurrency miner had been surreptitiously installed on the network and was draining the organisation\u2019s resources. 

Currency mining, in and of itself, isn\u2019t illegal. In fact, it\u2019s a central part of cryptocurrencies. At a fundamental level, by using special software miners solve math problems and, in return, are issued a certain number of coins. This process helps keep the currency secure by approving transactions and verifying them on the public ledger, or blockchain. 

The process is designed to be resource-intensive, and the equations purposefully difficult, as this ensures new coins are released at a steady rate. This is why criminals sling coin mining malware against organizations with high computing resources  \u2013 more CPU means more coins. 

Root cause of entry<\/strong>

The compromise began after a user clicked on a malicious URL, either a display ad or through URL redirection, executing a shell script disguised as a jpeg extension (logo.jpg). After the malicious link was clicked, the content-type field in the response contained the exploit code that added an entry to crontab and downloaded the malicious logo.jpg file.

That file was stored in the cron entry and exploited the \u2018\u2019 (CVE-2017-5638) vulnerability which allows an attacker to carry out Remote Code Execution (RCE) attacks. 

After this, a configuration file was downloaded from a remote server and stored in the victim machine, then the CPU was put to use mining Monero. The image below illustrates the infection steps:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figure 1 Infection steps<\/em>

Exploitation phase<\/strong>

As mentioned earlier, the Apache Struts vulnerability was pivotal in this attack. After gaining access, a blank file named \u201clclqhxwtts.conf\u201d was saved under the directory \/var\/tmp with read\/write permissions enabled. Then, a HTTP request downloaded the necessary configuration from a remote server. 

Any existing sshd files present in \/var\/tmp were deleted and replaced with the cryptocurrency mining support files, kworker and kworker_na, and saved in the directory \/var\/tmp\/sshd. This file\u2019s permissions were set to \u2018executable\u2019 then a cron entry for this file was created every 29 minutes. 

Let\u2019s take a closer look at these configuration files: 

“url” : “stratum+tcp:\/\/91.121.87(.)10:80”,

“user” : “46XG1vfKxfE1yQnPkrwdQoUDdewkqxCz8ZUnjtu4HH6j27uaWdXaC8D43Vax6XVZmGb3MTHaULEBoiBo7DbP3PPJLyffUcF”,

    “pass” : “x”,

Another configuration file included similar contents:

“url” : “stratum+tcp:\/\/94.23(.)206(.)130:80”,

“user” : “46XG1vfKxfE1yQnPkrwdQoUDdewkqxCz8ZUnjtu4HH6j27uaWdXaC8D43Vax6XVZmGb3MTHaULEBoiBo7DbP3PPJLyffUcF”,

    “pass” : “x”,

Here we see the \u2018User\u2019 detail set as the cryptocurrency wallet and the Password set as \u2018x\u2019 \u2013 a.k.a no password.

These files used the CryptoNight algorithm which is one of many algorithms used to mine cryptocurrencies. CryptoNight is designed to use CPU rather than GPU. 

Coin miner<\/strong>

In the attack\u2019s final step, the coin miner was dropped from 91.230.47(.)40 and it almost immediately began using the victim\u2019s CPU resources. As identified in the conf files, the coin wallet was: 46XG1vfKxfE1yQnPkrwdQoUDdewkqxCz8ZUnjtu4HH6j27uaWdXaC8D43Vax6XVZmGb3MTHaULEBoiBo7DbP3PPJLyffUcF.

Conclusion<\/strong>

Regular patching will keep the system safe from most coin mining infections. In this case, Apache Struts needs to be updated to the latest version, or a filter should be deployed for servlet to validate content-type \u2013 the initial means of infection in this scenario. 

The identified coin mining IP addresses should also be blocked in the firewall and proxy.

 <\/p>\n\n","protected":false},"excerpt":{"rendered":"

Most cyberattackers target the personal data or pocketbooks of their victims, but others are after something else entirely – processing power.  This was the case when we witnessed a spike in a customer’s CPU usage. The customer, who’s environment contained predominately Linux machines, reported nothing out of the ordinary. Our analysis quickly uncovered the culprit […]<\/p>\n","protected":false},"author":1,"featured_media":2439,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-2437","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=2437"}],"version-history":[{"count":3,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2437\/revisions"}],"predecessor-version":[{"id":4256,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2437\/revisions\/4256"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/2439"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=2437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=2437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=2437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}