Cryptocurrency boom fuels 2017 cybercrime surge
Abuse.ch reports a 2017 surge in cryptomining malware, Bitcoin-demanding extortion, and crypto-investment spam scams tied to rising coin prices.
Sourceabuse.ch — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This is a retrospective trend piece from abuse.ch reviewing how the 2017 cryptocurrency price boom shaped cybercriminal activity. The author notes that Bitcoin remains the preferred ransom currency for DDoS extortion groups (DD4BC, Armada Collective) and ransomware families (Crypt0L0cker, Locky, Cerber), and illustrates how the rising BTC price effectively multiplied the value of unclaimed ransom payments over time.
Separately, the researcher observed a sharp rise in cryptocurrency-mining malware samples starting mid-2017, growing from near zero to roughly 1,200 samples per month. These CoinMiners (e.g., XMRig, noobLoader) are frequently delivered as secondary payloads by droppers/loaders such as Smoke Loader and Neutrino, often bundled alongside banking trojans like Gozi, Citadel, and PandaZeuS — meaning infected machines are commonly compromised by multiple malware families simultaneously.
The article also documents a Swiss-focused spam campaign promoting fraudulent cryptocurrency trading platforms (thecryptosoftware.co, kryptohandel.trade, universemarkets.com) using snowshoe spam techniques from South African-hosted /24 netblocks, impersonating a fake entity called 'Internet Trends 2018' to lure victims into likely pyramid-scheme investment sites. Overall the piece is an informational trend summary rather than a report of a novel active threat.
Mentioned in this report
Detection guidance
Cryptocurrency Miner Process Execution from Dropper
A behavioural hunt for the technique in general.
Detects execution of known cryptocurrency mining tools (XMRig, noobLoader variants) spawned by dropper/loader processes, indicative of resource hijacking. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cryptocurrency Miner Process Execution from Dropper
description: Detects cryptocurrency miner tools (XMRig, noobLoader) launched by known
dropper/loader malware families (Smoke Loader, Neutrino). Targets the parent-child
process relationship and distinctive miner process names/paths rather than campaign-specific
hashes.
tags:
- attack.impact
- attack.t1496
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \SmokeLoader.exe
- \Neutrino.exe
selection_child:
Image|endswith:
- \xmrig.exe
- \xmrig-notls.exe
- \noobLoader.exe
CommandLine|contains:
- stratum
- pool.supportxmr.com
- mining
condition: selection_parent and selection_child
falsepositives:
- Legitimate cryptocurrency mining software installed by users
level: high
id: 20c0defc-4806-5f5c-a2bd-22113fedfb61
status: experimental
author: Vorant
Suspicious Process Spawning Multiple Malware Families
A behavioural hunt for the technique in general.
Detects a single parent process launching multiple distinct banking trojans and mining malware in sequence, characteristic of multi-payload dropper activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Process Spawning Multiple Malware Families
description: Detects dropper/loader processes (Smoke Loader, Neutrino) executing multiple
malware families (banking trojans Gozi, Citadel, PandaZeuS; miners XMRig, noobLoader)
in rapid succession. Targets the multi-child process pattern typical of commodity
droppers rather than specific campaign indicators.
tags:
- attack.impact
- attack.t1496
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \SmokeLoader.exe
- \Neutrino.exe
selection_banking:
Image|endswith:
- \gozi.exe
- \citadel.exe
- \pandazeus.exe
selection_miner:
Image|endswith:
- \xmrig.exe
- \noobLoader.exe
condition: selection_parent and (selection_banking or selection_miner)
falsepositives:
- Legitimate software bundle installers from enterprise deployment tools
level: medium
id: c77c94ea-9136-53e5-bd32-9fbd4d7fb25c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://abuse.ch/blog/cybercriminals-taking-advantage-of-cryptocurrency-boom
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs