Stealth Crypto Botnet Tweaks Its CPU to Optimize Mining Performance

• The comparison
• Computer Technology
• Stealth Crypto Botnet Tweaks Its CPU to Optimize Mining Performance

Cyber ​​security experts have discovered a new malware that modifies its victim's CPU to increase the performance of the machine as a crypto miner. Identified by cloud security company Uptycs, the malware attacks vulnerable Linux servers by exploiting known vulnerabilities in popular web servers. “The Uptycs threat research team recently observed a Golang-based worm that drops cryptominer binaries that use the Model Specific Register (MSR) driver to disable hardware pregrabbers and increase the speed of the mining process by 15%,” they revealed. the researchers in a blog post. .

TheComparison needs you! We take a look at how our readers are using VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey will take no more than 60 seconds of your time and we would greatly appreciate it if you would share your experiences with us.

Click here to launch the survey in a new window

Hardware preloading is a technique that allows processors to load data into the cache to speed up repetitive calculations and can be alternated with MSR.

Performance penalty

According to the researchers, while disabling the hardware preloader increases encryption performance, it reduces the performance of other legitimate applications running on the server. While the malware, first identified by Uptycs in June 2021, is similar to the strain Intezer discovered last year, the new variants use a bunch of new tricks. Researchers have already identified seven variants of the Goland-based deworming cryptominer, with subtle differences. Describing the cryptominer attack chain, the researchers say that the attack starts with a shell script, which first downloads the Golang worm. This worm then searches for and exploits existing server-based vulnerabilities, including CVE-2020-14882 and CVE-2017-11610. After breaking into a vulnerable server, the worm writes multiple copies of itself to various sensitive directories such as /boot, /efi, /grub, then drops the Xmrig ELF miner in /tmp. The miner then disables the hardware preloader using MSR, before starting work.