News European Airport Systems Infected With Monero-Mining Malware

European Airport Systems Infected With Monero-Mining Malware


- Advertisment -

More than 50% of all computing systems at a European international airport were recently found to be infected with a Monero cryptominer linked to the Anti-CoinMiner campaign Zscaler spotted during August 2018.

The cryptojacking attack was discovered by Cyberbit’s Endpoint Detection and Response team while deploying their security solution whose behavioral engine subsequently detected suspicious activity on some airport systems.

“The malware may have been used for months prior to the installation of Cyberbit EDR, although all workstations were equipped with an industry-standard antivirus,” said Cyberbit.

Luckily, besides affecting the infected systems’ overall performance and leading to increased power consumption, the XMRig Monero miner did not impact the airport’s operations.

Attack detected using behavioral analytics

While the cryptominer used to infect the airport’s computers was identified over a year ago, the attackers modified it sufficiently enough to make sure that it will not be identified by anti-malware software.

“The malware we found was first discovered by Zscaler more than a year ago,” found Cyberbit. “It was modified just enough to evade the vast majority of existing signatures for it, with only 16 out of 73 detection products on VirusTotal detecting the sample as malicious.”

Cyberbit discovered the infection because the threat actors repeatedly launched PAExec, a redistributable version of the legitimate Microsoft tool PsExec, a light-weight utility for executing processes remotely on other systems.

The tool was used for privilege escalation and it allowed them to launch an executable named Player “in system mode,” making it possible to gain maximum user privileges on the compromised systems.

VirusTotal detection rate

“System mode provides maximum privileges, so the miner would take priority over any other application for the use of workstation resources,” says the report.

“This impacts the performance of other applications, as well as that of the airport facility. The use of administrative privileges also reduces the ability for security tools to detect the activity.”

“The use of PAExec is often an indication of malicious activity, moreover the repeated use of the tool,” added the Cyberbit researchers.

Fileless malware tactics used to avoid detection

The attackers also used Reflective Dynamic-Link Library (DLL) loading (also known as Reflective DLL injection) — a known detection evasion technique used by malware operators — to inject malicious DLLs into a host process running in memory without using the Windows loader and completely bypassing the infected systems’ hard drives.

PAExec was also added by the malware into the systems’ registries to gain persistence to make sure that the airport employees can’t get rid of the infection by rebooting the impacted computers.

Registry entries added to gain persistence

While the infection vector is not yet known, the attackers could have used a wide range of methods, from dropping malicious payloads via phishing emails or infecting the systems with miners hidden in seemingly benign files using steganography, to using drive-by downloads for dropping a cryptominer binary or exploiting vulnerable servers [1, 2, 3] running on the airport’s network.

“In a worst-case scenario, attackers could have breached the IT network as a means to hop onto the airport’s OT network in order to compromise critical operational systems ranging from runway lights to baggage handling machines and the air-train, to name a few of the many standard airport OT systems that could be cyber-sabotaged to cause catastrophic physical damage,” concludes Cyberbit.



Please enter your comment!
Please enter your name here

Latest news

Make Fast and Secure Trades Using is a Cryptocurrency trading platform that allows users to buy and sell their Cryptocurrency in a...

Network Security Using Cryptography: Everything you need to know

This article will describe what is Network Security Using Cryptography and everything you need to know before...

Mercuriex Cryptocurrency Exchange Launches New Utility Token, SURF

MercuriEx Cryptocurrency Exchange, originally developed in 2017, came under new ownership in December 2019. Since taking over the exchange,...

Fungibility: Bitcoin Mixers Favorite Term That No One Understands

Fungibility, perhaps the most important concept when dealing with a decentralized and anonymous currency, but does bitcoin...
- Advertisement -European Airport Systems Infected With Monero-Mining Malware

Crypto can’t thrive in the real world – but stablecoins can

We can safely say that the hype about cryptocurrencies is pretty much over. The claims of Bitcoin...

How to double your crypto

Most of us have a small gambler deep inside our souls. We love to feel the thrill...

Must read

Make Fast and Secure Trades Using is a Cryptocurrency trading platform that...
- Advertisement -European Airport Systems Infected With Monero-Mining MalwareEuropean Airport Systems Infected With Monero-Mining Malware

You might also likeRELATED
Recommended to you