Good news, everyone: Ransomware declining. Bad news: Miscreants are turning to crypto-mining on infected PCs

For the past few years, ransomware has been a bane of computer users. These software nasties infect PCs, scramble files, and demand payment in cryptocurrency to restore the documents. Those cryptocurrencies are a right faff to get hold of and transfer to miscreants at short notice. And there's no guarantee crooks will hand …

[Mark 85]

If I'm reading this correctly, there's no app/script available to scan for these by non-corporate types? I'm thinking there should be some way to detect and shut these miners down on non-willing participants equipment.

[Prst. V.Jeltz]

no app/script available

"The only sign that a miner is installed is an increased CPU load on the infected machine"

Surely also if you looked at which process was causing the increased load you'd find a file that wasnt supposed to be there? On most servers this would be a process associated with its job, eg sqlservr.exe

Dosent malwarebytes (or other av) pick these things up? It seems to be able to pick up all sorts of other nasties that look much harder to detect . Its a mining operation! its noisy!

[ecofeco]

"The only sign that a miner is installed is an increased CPU load on the infected machine"

And how can we tell the difference between it and regular Microsoft operation?

[Dyson Lu]

That's why this has been targeting Windows machines. ;-)

[MyffyW]

Its a mining operation! its noisy!

Next big thing - unionisation amongst hijacked PCs, complete with a digital Arthur Scargill

[Claptrap314]

The article assumes that the miscreant placing NiceHash on people's machines is not the author of NiceHash....

[Francis Boyle]

You're a cynical bastard

but you've given me an idea.

[Adrian Harvey]

Tax evasion?

> but adds up to $31,000 a year, tax free.

What makes it tax free? My tax form (and I expect most other countries too). Have a box for "Other income - including tips, cash payments and profits of illegal enterprise"

Now I realise that many may not bother to pay, but that isn't quite the same as tax free.... is it? In any case in some parts the wrath of The Revenue is worse, and harder to avoid than the local law enforcement.

[Anonymous Coward]

Re: Tax evasion?

> "and profits of illegal enterprise"

Why is it that were it you and I, that would be called complicity in crime, but the ones who make the laws can get away with it just fine?

[Anonymous Coward]

Re: Tax evasion?

Mind, in Poland years ago the government decided against taxing the proceeds of prostitution precisely on the basis that it wasn't a legal activity in the land.

Suddenly lots of people started reporting a significant part of their income as being the proceeds of carnal exchange, something the tax office found unlikely (many of these were middle-aged male architects, lawyers and so on) so they started asking for customer lists as proof that your revenue did in fact come from an illegal activity.

[Anonymous Coward]

Well, all in all using your electricity for mining is a minor thing compared to the ransomware problems.

Perhaps this is like the evolution of new viruses - when they are new, they can be quite deadly to the host, but over time the the mortality rates decline.

[David Roberts]

Call the process

Meltdown mitigation.

Then people will leave it running and accept the performance hit.

[sitta_europea]

"The only sign that a miner is installed is an increased CPU load on the infected machine, and the occasional transfer of coinage out of the system."

And, er, another process in the process table?

[Prst. V.Jeltz]

indeed , and itll be the one at the top if ordered by cpu usage

[Herby]

Then there is another way...

I recently got a nice email that said that the people sending it have my keylogging and know that I have surfed porn. They won't tell if I send some bitcoin.

Thankfully I just ignored it as I knew it was untrue. On the other hand I suspect there are people out there who have fallen for it. At least there are no infections to deal with. Of course given the amount of infected email I come across (and ignore), it is but a small blessing.

[MonkeyCee]

coins stored locally?

"Miscreants can configure their malware to send back mined coins daily, but that increases the chance of detection"

That's a pretty odd configuration.

None of my miners collect the actual coins themselves. They are all mined to either a wallet address or to an account in a mining pool. Mining them to a local wallet just seems like asking for trouble even on your own system, let alone that you've gained illicit access to.

Using NiceHash miner seems a wee bit daft too, even ignoring screwing up the config. It's not exactl subtle software, and if you've got a GPU attached it will mine on that too. Which will generally be noticeable if only by fan noise.

[Anonymous Coward]

Re: coins stored locally?

>Using NiceHash miner seems a wee bit daft too..

Good choice IMO - you can throttle it down and hash a trendy cryptonight coin CPU only, but you still get paid for your enslaved farm in bitcoin by NiceHash.

[Anonymous Coward]

Re: coins stored locally?

It won't just be GPUs increasing noise as mining Moreno full tilt on a server will increase the servers fan usage massively. Was experimenting with 4 newish blades servers and the volume in the room increased substantially .

[ecofeco]

Symbiotic instead of parasitic

Evolution in action!

[Anonymous Coward]

Worst case scenario

Possible hardware damage especially on laptops.

[sjsmoto]

I'd like malware scanners to offer the option of letting it run but allowing me to accumulate the money. Why not? If I don't notice any slowdown on my PC, I wouldn't mind letting it run for my own benefit.

[veti]

That's like asking a doctor not to cut out the tumour in your brain, because it's helping to keep your head nice and warm.

[MyffyW]

Why not? If I don't notice any slowdown on my PC, I wouldn't mind letting it run for my own benefit.

Well if you don't pay for the electricity, then fill your boots, hun.