Understanding Illicit Cryptocurrency Mining: Threats and Best Practices for Prevention

Anything that has significant monetary value eventually attracts criminal activity. Such is the case with cryptocurrency, which since its earliest days has played a role in everything from the online purchases of illegal items to ransom demands from the bad actors behind ransomware attacks.

More recently we’ve witnessed the rise of illicit cryptocurrency mining, also known as cryptojacking, most cases of which are carried out with unsophisticated infrastructure and attack in place where vulnerabilities are known and patches are readily available. A malicious actor favoring cryptocurrency mining techniques can make a tidy profit if he or she knows where to look and wants to test what, for many, is a still-limited understanding of the threat’s significance.

Today the Cyber Threat Alliance (CTA) released “The Illicit Cryptocurrency Mining Threat,” a Joint Analysis paper describing the current state of the cryptocurrency mining threat, its potential impact to enterprises and individuals, and best practices all organizations should use to counter it. As a founding member of the CTA, whose mission it is to work together in good faith to share actionable cyber threat intelligence, Palo Alto Networks is pleased to include our research and analysis alongside other CTA members.

We expect this to remain a hot topic in the coming months. As the Joint Analysis notes:

“Illicit mining shows no signs of being just a phase for threat actors but will likely be a continuous and nearly effortless approach to revenue generation. As enterprises experiment with the use of blockchain technologies to conduct business operations, illicit mining outside of cryptocurrencies may itself become a disruptive risk that enterprises must mitigate.”

Get your copy of the CTA’s Joint Analysis on Illicit Cryptocurrency Mining here, along with a Key Facts sheet. And for all Palo Alto Networks Unit 42 research related to cryptocurrency mining, head here.