{"id":20135,"date":"2017-11-15T06:04:09","date_gmt":"2017-11-15T11:04:09","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=20135"},"modified":"2020-10-13T07:58:34","modified_gmt":"2020-10-13T11:58:34","slug":"from-ransomware-to-webminers","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/from-ransomware-to-webminers\/20135\/","title":{"rendered":"From ransomware to Web miners"},"content":{"rendered":"<p>No longer just the province of geeks, cryptocurrencies are starting to affect the lives of ordinary people much more than many ordinary people are inclined to think. Even if you don\u2019t use cryptocurrencies yourself, you are not immune to some of the problems associated with them.<\/p>\n<h2>Ransomware<\/h2>\n<p>You may not know or care much about bitcoins, but one not-so-fine day, a stranger might force you to start using them. In fact, cryptocurrencies have made monetization for malware creators easier than ever before.<\/p>\n<p>Think back five years. Malicious blockers displayed unwanted images on victims\u2019 screens, preventing access to their systems and files, and demanded ransom in the form of a paid SMS message sent to a premium phone number.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2017\/11\/15055730\/ransomware-blocker-scr.png\"><img decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2017\/11\/15055730\/ransomware-blocker-scr.png\" alt=\"\" width=\"978\" height=\"574\" class=\"aligncenter size-full wp-image-20139\"><\/a><\/p>\n<p>It was not smooth sailing for the attackers. Even if they were successful, the telecom company scooped up half of the money. Then, the premium phone numbers could be blocked, as could the money collected on corresponding accounts. Finally, perpetrators risked getting busted by the police when cashing out.<\/p>\n<p>Cryptocurrencies were a game changer. Today, encrypting ransomware is the bane of users who don\u2019t use good cybersecurity. This type of ransomware encrypts user data and demands a ransom payable in a cryptocurrency, and only after payment is made will the attacker (perhaps) send the decryption key to restore file access. Even those far from the world of cyberthreats have probably heard about <a href=\"https:\/\/securelist.com\/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world\/78351\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">WannaCry<\/a>.<\/p>\n<div id=\"attachment_20137\" style=\"width: 1034px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2017\/11\/15055514\/wannacry-ransom-note.png\"><img decoding=\"async\" aria-describedby=\"caption-attachment-20137\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2017\/11\/15055514\/wannacry-ransom-note.png\" alt=\"\" width=\"1024\" height=\"774\" class=\"size-full wp-image-20137\"><\/a><p id=\"caption-attachment-20137\" class=\"wp-caption-text\">Although WannaCry <a href=\"https:\/\/securelist.com\/a-kings-ransom-it-is-not\/79057\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">was actually a wiper<\/a>, it found notoriety as encrypting ransomware<\/p><\/div>\n<p>For attackers, cryptocurrencies must seem heaven-sent: no need to share the booty with anyone, no one to block their wallet, and, most important, no one to catch them while they\u2019re cashing out. Bitcoin is <a href=\"https:\/\/www.kaspersky.com\/blog\/bitcoin-blockchain-issues\/18019\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">not really anonymous<\/a>, but an attacker can use <a href=\"https:\/\/www.kaspersky.com\/blog\/good-good-blockchain\/19575\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">alternative cryptocurrencies<\/a> such as Monero or ZCash without fear of being tracked.<\/p>\n<p>This simplification of the monetization process has led to an unprecedented spread of ransomware.<\/p>\n<h2>Malicious miners<\/h2>\n<p>Mining \u2014 <a href=\"https:\/\/blog.kaspersky.ru\/mining-easy-explanation\/18020\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">reaping new cryptocoins by means of lengthy, complex calculations<\/a> \u2014 is no less popular as a form of cybercrime. A Trojan miner, unlike a Trojan cryptor, does not encrypt anything; it simply <a href=\"https:\/\/securelist.com\/miners-on-the-rise\/81706\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">starts secretly mining cryptocurrencies<\/a>, using a victim\u2019s computing power and electricity. Truth be told, this scenario is preferable to the previous one, and <a href=\"https:\/\/www.kaspersky.com\/blog\/is-antivirus-really-dead\/13959\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">unprotected users<\/a> may consider themselves lucky if their computers are merely used for covert mining, with no encrypting of valuable data.<\/p>\n<p>Incidentally, over the first eight months of 2017, our products <a href=\"https:\/\/securelist.com\/it-threat-evolution-q3-2017\/83076\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">protected 1.65 million users from malicious miners<\/a>, and we expect this figure to cross the 2 million mark by year\u2019s end.<\/p>\n<h2>Web mining<\/h2>\n<p>Crafty developers began funding their projects by <a href=\"https:\/\/torrentfreak.com\/new-utorrent-release-breaks-ties-with-bitcoin-miner-150413\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">inserting miners in their software<\/a>, but Pandora\u2019s box opened wide when mining was implemented directly in the browser. After that, everything became even simpler \u2014 now users can be conscripted into a mining scheme just by visiting a website that makes the browser download a script that makes their computer mine money.<\/p>\n<p>This innovation is seriously restructuring money-making schemes online. Some websites have even elected to stop displaying banners, relying instead on <a href=\"https:\/\/torrentfreak.com\/the-pirate-bay-website-runs-a-cryptocurrency-miner-170916\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">mining visitors\u2019 computers<\/a>. Instead of using CAPTCHAs just to filter out bots, it would be more profitable to make use of those bots for mining \u2014 who cares if a visitor is a real person or a bot if they mine equally well?. It could even be profitable to let users watch new movies without charging them a fee, and just mine away in the background while the flick is playing.<\/p>\n<p>It doesn\u2019t stop there. After hacking a popular resource, there\u2019s no need to bother exploiting vulnerabilities in visitors\u2019 software and infecting them with malware; after all, everything still has to be monetized. It\u2019s far easier, and more profitable, to upload a script to the hacked website that forces visitors\u2019 computers to mine money straight into the hacker\u2019s cryptowallet.<\/p>\n<p>Cybercriminals are highly adept at switching to the latest, most lucrative method. So I\u2019m calling it now: Next year is likely to be the year of malicious Web miners \u2014 that\u2019s where the smart (and quick) money is for malware makers.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kis-trial-cyberattacks\">\n","protected":false},"excerpt":{"rendered":"<p>Next year is likely to see malware creators and distributors switch from ransomware to malicious Web miners.<\/p>\n","protected":false},"author":669,"featured_media":20136,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2683],"tags":[2758,2640,1680,1295,36,2756,420,422,2757],"class_list":{"0":"post-20135","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-coinhive","9":"tag-cryptocurrencies","10":"tag-cryptors","11":"tag-forecasts","12":"tag-malware-2","13":"tag-miners","14":"tag-ransomware","15":"tag-threats","16":"tag-web-miners"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/from-ransomware-to-webminers\/20135\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/from-ransomware-to-webminers\/12224\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/from-ransomware-to-webminers\/12063\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/from-ransomware-to-webminers\/14814\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/from-ransomware-to-webminers\/14679\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/from-ransomware-to-webminers\/19186\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/from-ransomware-to-webminers\/4437\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/from-ransomware-to-webminers\/8541\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/from-ransomware-to-webminers\/15281\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/from-ransomware-to-webminers\/18756\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/threats\/","name":"threats"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/20135","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/669"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=20135"}],"version-history":[{"count":8,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/20135\/revisions"}],"predecessor-version":[{"id":37299,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/20135\/revisions\/37299"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/20136"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=20135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=20135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=20135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}