I Just seen this
500,000 computers infected in 12 hours, mining Electroneum
A quickly spreading cryptojacking infection, geared to mine Electroneum, has been detected.
Just before noon on 6 March Microsoft picked up more than 80,000 instances of the same sophisticated trojan. In the next 12 hours, more than 400,000 other instances were recorded. 73% of it was in Russia, 18% in Turkey and 4% in Ukraine.
It turned out to be a new variant of a Dofoil or Smoke Loader trojan, equipped with a cryptocurrency mining payload. The coin miner is believed to use the NiceHash system which can be geared to mine a range of coins, but this particular attack was geared to mine Electroneum.
Electroneum might have been a tempting option for the attackers because it was designed to let people mine with their phones, which tend to be considerably less powerful than PCs. So someone with half a million computers at their disposal might be able to make considerable returns.
Microsoft said that it was a sophisticated piece of malware, designed to stay hidden for a long time by masquerading as a genuine Windows function, but did not say how it managed to spread so quickly.
Dofoil has a long history as a malware downloader, using a system called "process hollowing." This means it duplicates a suitable legitimate process, then hollows it out and replaces the contents with malicious code to remain undetected. This hollowed program then spawns the cryptocurrency mining program which also masquerades as a legitimate process.
From here it connected to a remote command and control server hosted on the decentralised Namecoin network. This server would then give the malware commands, including connecting or disconnecting from IP addresses, download a file and executing or terminating it, or sleeping for a period of time. Like most cryptojackers, it was engineered to stay hidden for as long as possible in order to extract as much value from its host computers.Windows Defender AV initially flagged the attacks unusual persistence mechanism through behavior monitoring, which immediately sent this behavior-based signal to our cloud protection service.
Within milliseconds, multiple metadata-based machine learning models in the cloud started blocking these threats at first sight.
Seconds later, our sample-based and detonation-based machine learning models also verified the malicious classification. Within minutes, detonation-based models chimed in and added additional confirmation.
Within minutes, an anomaly detection alert notified us about a new potential outbreak.
After analysis, our response team updated the classification name of this new surge of threats to the proper malware families. People affected by these infection attempts early in the campaign would have seen blocks under machine learning names like Fuery, Fuerboos, Cloxer, or Azden. Later blocks show as the proper family names, Dofoil or Coinminer.
Since Microsoft picked it up, it can now be detected by Windows 10, Windows 8.1 and Windows 7 users running Windows Defender AV or Microsoft Security Essentials, and probably other antivirus systems too.
