Blog

No items found.

How AI caught hackers crypto-mining on a biometric access server in an empty office

How AI caught hackers crypto-mining on a biometric access server in an empty officeDefault blog imageDefault blog image
10
Aug 2020
10
Aug 2020

Darktrace recently detected a crypto-mining campaign that used the processing power of a corporate server to mine cryptocurrency at a manufacturing firm based in APAC. This server was in control of biometric door access within the client’s office and first downloaded a suspicious executable before beginning to mine for cryptocurrency. This occurred while the firm’s physical office was closed, with all employees working remotely due to COVID-19.

External-facing servers often face increased risk of compromise due to frequent touchpoints with the internet. It is vital that security teams are made aware of malicious activity on these devices as quickly as possible given their role in managing various business operations. Crypto-mining is difficult for many security tools to detect, particularly due to encrypted communications, and can go undetected on servers for long periods of time, slowing or damaging business operations.

Armed with an understanding of ‘normal’ for this manufacturing firm Darktrace’s AI was able to recognize the anomalous behavior, and the Cyber AI Analyst launched a fully autonomous investigation into the incident.

Figure 1: A timeline of the attack

The first signs of compromise

Darktrace identified an internet-facing server downloading a suspicious executable file, Securitcy.111, from a new external IP that had never been seen on the network before. The server had RDP, SMB, and SQL ports open externally – a successful incoming SQL connection from the external IP was seen shortly before the file download, suggesting a likely source of compromise. Successful RDP and SMB version 1 connections were also seen around the time of this activity.

Following this file download, the server began to repeatedly connect to external endpoints using self-signed TLS certificates. These endpoints are associated with mining pools for the digital currency Monero.

Darktrace’s detection

Despite a lack of threat intelligence on the external source of the file download, Darktrace’s AI easily detected that this behavior was highly unusual, alerting the firm to the serious emerging incident and enabling the customer to quickly take action. Instead of relying on known IoCs, the crypto-mining connections were immediately identified by Darktrace as suspicious due to their use of self-signed TLS certificates, alongside the statistical rarity of the endpoints for the business.

The new user agent was generic, and commonly associated with legitimate and malicious processes alike. This use of user agents means that C2 communication is less likely to be detected by the traditional security stack, however its unusual use was immediately flagged by Darktrace as suspicious.

AI Analyst coverage

Darktrace’s Cyber AI Analyst investigated this crypto-mining incident, providing an immediate indication that the device had been compromised.

Figure 2: Screenshot of AI Analyst detection of the crypto-mining

The below image shows the infected device over the same five-day period, with model breaches represented by dots and color indicating severity. The clear increase in model breaches on the device during this activity is a clear indication of compromise.

Figure 3: A graph showing a large increase in models breached by the device on 3 June

Figure 4: A sample of models breached by the server at the time of this compromise

As thousands of organizations moved to remote working this year – with the questions of when, how, and whether to return still unanswered – it is critical to ensure that physical IT infrastructure within offices remains secure. Internet-facing servers in particular must be able to withstand a multitude of external threats. This incident demonstrates the importance of security tools that can not only detect known IoCs, but emerging and unknown incidents.

Darktrace’s AI-powered approach was able to immediately detect the suspicious behavior and identify the compromise. Thanks to Darktrace’s quick detection, and the investigation of the Cyber AI Analyst, the client could remediate the crypto-mining infection.

Thanks to Darktrace analyst Emma Foulger for her insights on the above threat find.

Learn more about Cyber AI Analyst

IoCs:

IoCComment185.170.210[.]59Download of payloadURI:/img/zhu/Securitcy.111File hashes:548022246f3c76c8c79ee762fe7e0050a0cf8396,e809a00daa7c18fd5101e8516435575c219709d4107.178.104[.]1039.99.124[.]170139.99.123[.]196139.99.125[.]38192.110.160[.]114Pool-hk.supportxmr[.]comMonero mining destinations

Darktrace model detections:

  • Anomalous File / Masqueraded File Transfer
  • Anomalous File / Internet Facing System File Download
  • Anomalous File / EXE from Rare External Location
  • Anomalous Connection / Rare External SSL Self-Signed
  • Device / Anomalous SMB Followed By Multiple Model Breaches
  • Device / Anomalous RDP Followed By Multiple Model Breaches
  • Anomalous File / Multiple EXE from Rare External Locations
  • Anomalous Connection / New User Agent to IP Without Hostname
  • Device / Initial Breach Chain Compromise
  • Compromise / Monero Mining
  • Compromise / Uncommon Monero Mining

Like this and want more?

Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Max Heinemeyer
Chief Product Officer

Max is a cyber security expert with over a decade of experience in the field, specializing in a wide range of areas such as Penetration Testing, Red-Teaming, SIEM and SOC consulting and hunting Advanced Persistent Threat (APT) groups. At Darktrace, Max oversees global threat hunting efforts, working with strategic customers to investigate and respond to cyber-threats. He works closely with the R&D team at Darktrace’s Cambridge UK headquarters, leading research into new AI innovations and their various defensive and offensive applications. Max’s insights are regularly featured in international media outlets such as the BBC, Forbes and WIRED. When living in Germany, he was an active member of the Chaos Computer Club. Max holds an MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.

USE CASES
No items found.
PRODUCT SPOTLIGHT
No items found.
COre coverage
No items found.
This Article
How AI caught hackers crypto-mining on a biometric access server in an empty office
Share
Twitter logoLinkedIn logo

Related Articles

No items found.

Good news for your business.
Bad news for the bad guys.

Start your free trial

Start your free trial

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get a demo

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.