Cryptojacking in Ukraine

 The act of exploiting a computer to mine cryptocurrenciesis called "cryptojacking".

The Ukrainian National Police and Europol have announced the arrest of an individual believed to be involved in a $2 million cryptojacking operation. The operation started in 2021.

The hacker created more than ONE MILLION virtual computers to mine cryptocurrency.

“By stealing cloud resources to mine cryptocurrencies, the criminals can avoid paying the necessary servers and power, the cost of which typically outweighs the profits. The compromised account holders are left with huge cloud bills,” Europol notes.

https://www.securityweek.com/hacker-accused-of-running-2-million-cryptocurrency-mining-scheme-arrested-in-ukraine/?is=5a5d7ed30c1b46eb1c21fcf1e6c51b4c49dc532ddd4c930a7f4472ce34fe37c3

"As part of the operation, which started in 2021, the miscreant targeted the servers of one of the largest ecommerce companies, hacking more than 1,500 user accounts in automated password brute-forcing attacks, the Ukrainian authorities announced.

The attacker then gained management access and infected the service with cryptocurrency mining malware."

"Threat actors are known to target cloud servers for cryptojacking due to the high computing power these environments provide."

"In October, Palo Alto Networks revealed that, for two years, a threat actor had been harvesting IAM credentials from public GitHub repositories within minutes of exposure, using them to set up AWS Elastic Compute (EC2) instances for illicit crypto-mining."

Hack of Danish Energy Companies

There are still many people in the companies who are still not aware of the cybersecurity risks and who underestimate the cyber threats. They wake up after they see their company in the hacking news on the internet while considering to pay (or not pay) the ransom which is requested by the hacker groups.

So be aware before you see your company in the hacking news the next day. Be aware that it is not a joke. Be aware that cyber threats are for real. Do not hesitate to spend enough budget for cyber security. Otherwise you will have to spend much more then that for hackers after you have been hit by a ransomware attack.

It is known that Ukrainian critical infrastructures are being attacked for more than 10 years (Allegedly by Russian affiliated hacker groups.) But Ukraine remained not the only victim.

Nearly two dozen Danish energy companies were hacked through a firewall bug in May 2023 which is also stated in a report of Forescout which is published this week. (A Critical Analysis of Recent Energy Sector Attacks in Denmark and Ukraine.)

You can read the report of Forescout in the link below:

https://www.forescout.com/resources/clearing-the-fog-of-war/?is=5a5d7ed30c1b46eb1c21fcf1e6c51b4c49dc532ddd4c930a7f4472ce34fe37c3

https://therecord.media/denmark-attacks-forescout-analysis-zyxel?is=5a5d7ed30c1b46eb1c21fcf1e6c51b4c49dc532ddd4c930a7f4472ce34fe37c3

"What happened in Denmark can also happen to you, cybersecurity researchers are warning in a new report that examines attacks against the country’s energy sector last year."

"The takeaway is that 'critical infrastructure organizations across Europe should remain alert to attacks on unpatched network infrastructure devices.'"

""...Nearly two dozen companies were affected, and the intrusions usually involved the abuse of products from the Taiwan-based manufacturer Zyxel,..."

"...The problem for administrators, Forescout said, is the 'common lack of detection and hardening capabilities around native OT scripting functionality.'"