Cryptocurrency boom fuels 2017 cybercrime surge

8 January 2018 routine threat financial-services

Abuse.ch reports a 2017 surge in cryptomining malware, Bitcoin-demanding extortion, and crypto-investment spam scams tied to rising coin prices.

This is a retrospective trend piece from abuse.ch reviewing how the 2017 cryptocurrency price boom shaped cybercriminal activity. The author notes that Bitcoin remains the preferred ransom currency for DDoS extortion groups (DD4BC, Armada Collective) and ransomware families (Crypt0L0cker, Locky, Cerber), and illustrates how the rising BTC price effectively multiplied the value of unclaimed ransom payments over time.

Separately, the researcher observed a sharp rise in cryptocurrency-mining malware samples starting mid-2017, growing from near zero to roughly 1,200 samples per month. These CoinMiners (e.g., XMRig, noobLoader) are frequently delivered as secondary payloads by droppers/loaders such as Smoke Loader and Neutrino, often bundled alongside banking trojans like Gozi, Citadel, and PandaZeuS — meaning infected machines are commonly compromised by multiple malware families simultaneously.

The article also documents a Swiss-focused spam campaign promoting fraudulent cryptocurrency trading platforms (thecryptosoftware.co, kryptohandel.trade, universemarkets.com) using snowshoe spam techniques from South African-hosted /24 netblocks, impersonating a fake entity called 'Internet Trends 2018' to lure victims into likely pyramid-scheme investment sites. Overall the piece is an informational trend summary rather than a report of a novel active threat.

Mentioned in this report

Threat actors Armada CollectiveDD4BC

Malware CerberCitadelCrypt0l0ckerGoziLockyNeutrinoPandaZeuSSmoke LoaderXMRIGnoobLoader

Detection guidance

Cryptocurrency Miner Process Execution from Dropper

ATT&CK T1496

Detects execution of known cryptocurrency mining tools (XMRig, noobLoader variants) spawned by dropper/loader processes, indicative of resource hijacking. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Cryptocurrency Miner Process Execution from Dropper
description: Detects cryptocurrency miner tools (XMRig, noobLoader) launched by known
  dropper/loader malware families (Smoke Loader, Neutrino). Targets the parent-child
  process relationship and distinctive miner process names/paths rather than campaign-specific
  hashes.
tags:
- attack.impact
- attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \SmokeLoader.exe
    - \Neutrino.exe
  selection_child:
    Image|endswith:
    - \xmrig.exe
    - \xmrig-notls.exe
    - \noobLoader.exe
    CommandLine|contains:
    - stratum
    - pool.supportxmr.com
    - mining
  condition: selection_parent and selection_child
falsepositives:
- Legitimate cryptocurrency mining software installed by users
level: high
id: 20c0defc-4806-5f5c-a2bd-22113fedfb61
status: experimental
author: Vorant

Suspicious Process Spawning Multiple Malware Families

ATT&CK T1496

Detects a single parent process launching multiple distinct banking trojans and mining malware in sequence, characteristic of multi-payload dropper activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Process Spawning Multiple Malware Families
description: Detects dropper/loader processes (Smoke Loader, Neutrino) executing multiple
  malware families (banking trojans Gozi, Citadel, PandaZeuS; miners XMRig, noobLoader)
  in rapid succession. Targets the multi-child process pattern typical of commodity
  droppers rather than specific campaign indicators.
tags:
- attack.impact
- attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \SmokeLoader.exe
    - \Neutrino.exe
  selection_banking:
    Image|endswith:
    - \gozi.exe
    - \citadel.exe
    - \pandazeus.exe
  selection_miner:
    Image|endswith:
    - \xmrig.exe
    - \noobLoader.exe
  condition: selection_parent and (selection_banking or selection_miner)
falsepositives:
- Legitimate software bundle installers from enterprise deployment tools
level: medium
id: c77c94ea-9136-53e5-bd32-9fbd4d7fb25c
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://abuse.ch/blog/cybercriminals-taking-advantage-of-cryptocurrency-boom

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free