Darktrace recently detected a crypto-mining campaign that used the processing power of a corporate server to mine cryptocurrency at a manufacturing firm based in APAC. This server was in control of biometric door access within the client’s office and first downloaded a suspicious executable before beginning to mine for cryptocurrency. This occurred while the firm’s physical office was closed, with all employees working remotely due to COVID-19.

External-facing servers often face increased risk of compromise due to frequent touchpoints with the internet. It is vital that security teams are made aware of malicious activity on these devices as quickly as possible given their role in managing various business operations. Crypto-mining is difficult for many security tools to detect, particularly due to encrypted communications, and can go undetected on servers for long periods of time, slowing or damaging business operations.

Armed with an understanding of ‘normal’ for this manufacturing firm Darktrace’s AI was able to recognize the anomalous behavior, and the Cyber AI Analyst launched a fully autonomous investigation into the incident.

Figure 1: A timeline of the attack

The first signs of compromise

Darktrace identified an internet-facing server downloading a suspicious executable file, Securitcy.111, from a new external IP that had never been seen on the network before. The server had RDP, SMB, and SQL ports open externally – a successful incoming SQL connection from the external IP was seen shortly before the file download, suggesting a likely source of compromise. Successful RDP and SMB version 1 connections were also seen around the time of this activity.

Following this file download, the server began to repeatedly connect to external endpoints using self-signed TLS certificates. These endpoints are associated with mining pools for the digital currency Monero.

Darktrace’s detection

Despite a lack of threat intelligence on the external source of the file download, Darktrace’s AI easily detected that this behavior was highly unusual, alerting the firm to the serious emerging incident and enabling the customer to quickly take action. Instead of relying on known IoCs, the crypto-mining connections were immediately identified by Darktrace as suspicious due to their use of self-signed TLS certificates, alongside the statistical rarity of the endpoints for the business.

The new user agent was generic, and commonly associated with legitimate and malicious processes alike. This use of user agents means that C2 communication is less likely to be detected by the traditional security stack, however its unusual use was immediately flagged by Darktrace as suspicious.

AI Analyst coverage

Darktrace’s Cyber AI Analyst investigated this crypto-mining incident, providing an immediate indication that the device had been compromised.

Figure 2: Screenshot of AI Analyst detection of the crypto-mining

The below image shows the infected device over the same five-day period, with model breaches represented by dots and color indicating severity. The clear increase in model breaches on the device during this activity is a clear indication of compromise.

Figure 3: A graph showing a large increase in models breached by the device on 3 June

Figure 4: A sample of models breached by the server at the time of this compromise

As thousands of organizations moved to remote working this year – with the questions of when, how, and whether to return still unanswered – it is critical to ensure that physical IT infrastructure within offices remains secure. Internet-facing servers in particular must be able to withstand a multitude of external threats. This incident demonstrates the importance of security tools that can not only detect known IoCs, but emerging and unknown incidents.

Darktrace’s AI-powered approach was able to immediately detect the suspicious behavior and identify the compromise. Thanks to Darktrace’s quick detection, and the investigation of the Cyber AI Analyst, the client could remediate the crypto-mining infection.

Thanks to Darktrace analyst Emma Foulger for her insights on the above threat find.

Learn more about Cyber AI Analyst

IoCs:

IoCComment185.170.210[.]59Download of payloadURI:/img/zhu/Securitcy.111File hashes:548022246f3c76c8c79ee762fe7e0050a0cf8396,e809a00daa7c18fd5101e8516435575c219709d4107.178.104[.]1039.99.124[.]170139.99.123[.]196139.99.125[.]38192.110.160[.]114Pool-hk.supportxmr[.]comMonero mining destinations

Darktrace model detections:

• Anomalous File / Masqueraded File Transfer
• Anomalous File / Internet Facing System File Download
• Anomalous File / EXE from Rare External Location
• Anomalous Connection / Rare External SSL Self-Signed
• Device / Anomalous SMB Followed By Multiple Model Breaches
• Device / Anomalous RDP Followed By Multiple Model Breaches
• Anomalous File / Multiple EXE from Rare External Locations
• Anomalous Connection / New User Agent to IP Without Hostname
• Device / Initial Breach Chain Compromise
• Compromise / Monero Mining
• Compromise / Uncommon Monero Mining

‍