Hello, World!
Cyber Criminals are mining crypto on github, A hacker who’s death was faked has been
arrested, and there’s a new kind of ransomware which frames security researchers.
That’s all coming up in today’s roundup of cyber security tech news.
A massive crypto mining operation has been discovered, which literally runs on github.
But, how does that work?
Well, github has a certain feature which cybercriminals love - Github actions - this feature allows
developers to spin up a temporary virtual machine on github’s servers, so they can
automate tasks like code compilation and testing.
But because this runs on a standard VM, it can be used to do almost anything, like…
mine crypto.
And the very second Github added 2,000 minutes per month of this compute power to their free
tier, cyber criminals have been all over it like a moth to a lamp.
However, there is a catch - whilst these VMs are fast enough for what they’re designed
for.
They suck at cryptomining…
I mean, forget high performance GPUs, these things run on just 2 CPU cores…
so mining is incredibly slow******,****** meaning miscreants have to, be creative.
And in this latest campaign uncovered by researchers, this means that the group behind it - which
the researchers are calling “Purple Urchin”, for some reason, are mass creating thousands
of bot accounts, not just on Github, but on other platforms which offer a free tier of
a similar service.
And, the way “Purple Urchin” mass creates accounts is really quite clever, they use
a load of different VPNs so each account is created under a different IP, they also use
a special tool to automate mouse and keyboard action when clicking through the account creation
screen on Github’s website.
At this point only the captcha is standing in their way - but many captcha’s (github’s
included) have an option for visually impaired, this means listening to a bit of audio and
typing out the numbers - “PurpleUrchin” bypasses this with the help of a speech to
text AI.
And, after this hurdle, “Purple Urchin” has another bot, and of course this whole
process is scripted, so they don’t have to lift a finger.
Thousands of bots later, “PurpleUrchin” has an army to be reckoned with.
But, what’s the goal here?
And, I realise that might sound like a dumb question, I mean, they’re mining crypto…
literally printing money.
But the devil’s in the detail…
they’re mining really low profit margin coins - I believe the technical term for these
is “shitcoins”.
So, its thought this whole operation could just be a test, a pre-cursor to a larger campaign
where they might mine something like Monero - and, let’s assume that is the plan, just
how much money would they make mining Monero on github?
This is where it starts to get kinda ridiculous, because for every 1 Monero the cyber criminals
mine on these VMs, it would cost github over a hundred thousand dollars.
Simply because mining in a VM which is running on only a couple CPU cores is incredibly inefficient,
but hey “Purple Urchin” aren’t footing the electricity bill here, so why would they
care?
But an alternative theory is they’re targeting these small coins because it’s easier to
attack their underlying blockchain.
As in, when it comes to crypto if you control 51% of a network’s hashrate, then you can
control the entire network, and validate arbitrary transactions, potentially stealing millions
of dollars.
This is much more doable on smaller, less relevant coins.
But regardless of their intent, ever since the researchers published their findings,
Purple Urchin’s campaign, has evaporated.
Nevertheless, cryptomining using cloud services remains a huge problem for platforms.
And one such platform, Heroku, has announced that because, their “security teams are
spending an extraordinary amount of effort to manage fraud and abuse of the [their] free
product plans” - they “plan to stop offering free product plans” altogether.
And whilst Github has made some changes to their service to combat cryptomining abuse,
they’ve kept their free tier, and so the cryptomining continues.
The alleged operator behind the notorious malware “racoon stealer”, has been arrested
after his cyber criminal friends seemingly faked his death.
But, let’s back up a bit, so, Raccoon stealer spawned in 2019, latching on to the ‘malware
as a service’ trend.
As in, rather than use it themselves the developers rent it out to other cyber criminals on a
subscription model.
As in, the developers behind “raccoon stealer” don’t infect anyone with it themselves,
instead they rent it out to other cyber criminals on a subscription model, kinda like Netflix.
For $200 per month, customers get a web interface where they can generate custom versions of
“racoon stealer”, manage the computers they’ve infected, and most importantly…
retrieve stolen credentials…
Because “raccoon stealer” is primarily an infostealer, as in, after infecting a PC
it’ll exfiltrate saved passwords, credit cards, crypto wallets and so on - it can steal
data from nearly 60 apps.
And unfortunately this malware is really noob friendly, as customers don’t have worry
about operating their own servers or developing their own malware, they only have to deal
with spreading the malware, whether that be with phishing emails, fake cracked software,
or in one case someone went so far as to set up a fake ‘play to earn game’, ‘cthulhu
world’, with the sole intent of spreading this malware.
So, raccoon stealer had become incredibly popular among cyber miscreants, but… the
party was crashed in March when they abruptly announced that they “[had] to close [their]
Raccoon stealer project”.
Because “due to the special operation” - referring to the war in Ukraine, members
of their team had been killed.
They added that some of their servers have “already stopped responding”.
But it seems that this was all a lie, I mean, well - their servers had stopped responding,
but for different reasons…
You see, the guy they’re referring to who was killed in the war, is allegedly one “Mark
Sokolovsky” - apparently one of Raccoon stealer’s key developers.
But far from dying in the war, he fled it, he’s thought to have bribed Ukrainian border
guards in order to leave the country (because of course there’s currently a ban on men
leaving Ukraine), he was then snapped crossing the border from Poland into Germany in his
Porsche…
I wonder where he got the money for that from…
He eventually arrived in Amsterdam, with who I’m guessing is his girlfriend, who… documented
their little adventure on Instagram.
Bad idea, because shortly after he was arrested by Dutch police, and is now facing extradition
to the US on charges which could land him in prison for 20 years.
But a few questions remain unanswered, how did US authorities, the FBI in this case,
figure out his real identity?
Court documents don’t explain, but thanks to anonymous sources which tipped off a popular
cyber security blog.
It seems, our miscreant made one tiny - but fatal opsec mistake.
Early on in his cyber crime career - under one of his pseudonyms “Photix”, he made
a post on a cyber crime forum which referenced a certain gmail account, the FBI discovered
it was connected to an iCloud account, and at this point everything unravelled, the feds
accessed it and found a bunch of incriminating evidence, including this picture - at which
point they were probably just waiting for an opportunity to arrest him, which his trip
to Amsterdam provided.
As for why his “raccoon stealer” team members faked his death - well I can’t imagine
admitting one of your main guys has been arrested and one of your servers had been seized by
the FBI would be very good for business.
Because shortly after they announced they were shutting down, they u-turned saying they
were going offline to rework some code, and to “expect [them back] in a few months”,
they even doubled down on the fake death of their team member, saying, they “will continue
to work in his honour”.
It’ll be interesting to see how their comeback goes after these new revelations.
As to the server the FBI seized, they found over 50 million stolen credentials on it,
and they’ve launched a website where you can check if your email address is included
in the data dump.
A strange new kind of ransomware has appeared, who’s main purpose is to frame security
researchers.
This is bizarre…
so victims have been finding their files encrypted with the ‘azov’ file extension, hidden
within - is a ransom note.
You’d be forgiven for thinking that that this is just regular ransomware, perpetrated
by some cyber criminal intent on extorting people out of a couple hundred dollars of
Monero.
But, not quite - the note starts with “Hello, my name is Hasherezade”, a “Polish security
expert”, and to “recover your files, contact us on Twitter”, listing a bunch of Twitter
accounts belonging to prominent cyber security researchers, who have nothing to do with this
ransomware.
This whole thing is obvious bs - specifically manufactured just to cause problems for these
researchers, by some unknown person with a grudge against them for some reason, or maybe
they’re just doing it for some twisted kind of fun… problem is though if you’re a
normie who just so happens to succumb to this ransomware…
you don’t know that.
And people on this list have reported that “victims have already started contacting
[them] for help recovering files”.
The rest of the ransom note is about the war in Ukraine, claiming the purpose of this ransomware
is “to bring your attention to the problem”, it’s written from the perspective of someone
who’s pro Ukrainian.
But this just seems to just be a badly written false pretext for spreading this ransomware,
I mean - there are reports of Ukrainian organisations being infected with this.
And for some reason the note signs off with #TaiwanIsChina.
It just doesn’t make any sense, but I guess the note just doesn’t need to.
I realise so far, I’ve been describing this as “ransomware”, but it’s more akin
to data wiping malware - as there’s no way for a victim to retrieve their files.
I mean, the security researchers implicated have nothing to do with all this, and there’s
no contact information for whoever is actually behind it.
So victims are pretty much out of luck.
And unfortunately it is quite easy for someone with way too much time on their hands to pull
off an operation like this - as this malware isn’t being spread by some sophisticated
method, there’s no phishing campaign, no vulnerabilities that are being taking advantage
of.
Instead the miscreant behind this has been taking the low effort approach of just buying
installs on hacking forums.
And by that I mean, they’ve been paying botnet operators to execute this malware on
a number their bots.
And, this is a lot cheaper than you’d expect, with botnet owners typically charging just
10 cents per install.
So, armed with just a couple hundred dollars, someone could potentially cause havoc on thousands
of computers.
This video was made possible by Octopart - a website I've been relying on over the last
few years in my electronics business.
Octopart.com is essentially your component sourcing swiss army knife - making it simple
to keep tabs on component stock levels in real time throughout a range of distributors
- which is pretty important given the current component supply situation, you can also easily
grab datasheets and cad models for components when you need them.
The best part is it's free to use, and Octopart is integrated right into altium 365, if you
want to give altium a go you can find your free trial link in the description.
As always thanks for watching, and I’ll see you in the next video, have a good one.