Monero mining botnet 'Smominru' earns hackers $3.6 million

Smominru uses EternalBlue, a Windows exploit developed by the NSA and leaked by the hacking group Shadow Brokers, to spread across computers.

A global botnet dubbed “Smominru” has been secretly mining Monero on infected machines and making millions of dollars for its owners, according to research from Proofpoint.

The operators have mined about 8,900 Monero valued at up to $3.6 million at a rate of 24 Monero ($8,500) per week.

Researchers have watched the Smominru botnet spread since May 2017. Now including over 526,000 infected Windows hosts, Smominru uses EternalBlue, a Windows exploit developed by the NSA and leaked by the hacking group Shadow Brokers.

The Smominru botnet’s command and control infrastructure is hosted behind SharkTech, a hosting and DDoS protection service, that reportedly ignored repeated abuse notification.

SharkTech did not respond to a request for comment.

“This Monero mining botnet is extremely large, made up mostly of Microsoft Windows servers spread around the globe,” Kevin Epstein, a vice president of threat operations at Proofpoint, said in a release. “Taking down the botnet is very difficult given its distributed nature and the persistence of its operators. For businesses, preventing infection through robust patching.”

Cryptojacking is the practice of using infected machines to mine cryptocurrency without a user’s authorization, resulting in overloaded CPUs and crashed processes. It’s an increasingly popular and lucrative line of business for criminals;  cryptojacking software known as Coinhive is the most prevalent malware online today.

Monero is a cryptocurrency with a much stricter focus on privacy than more popular currencies like bitcoin. Experts have long predicted and seen cybercriminals move toward Monero because it’s easier for hackers to earn big scores without being caught by police. Smominru is one of the most lucrative signs yet of Monero’s adoption in the criminal underground.

New research from Cisco’s Talos division suggested large, organized cryptojacking botnets can pull in tons of money. A typical PC generates about $0.28 worth of Monero per day, meaning that large botnets can bring it up to $100 million per year.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure