WannaCry Has a More Lucrative Cousin That Mines Cryptocurrency for Its Masters

The same exploits that allowed the WannaCry ransomware attack to spread so quickly have been used to set up an illicit cryptocurrency mining scheme. And it sure was worth it to the hackers.
Late last week, the world was hit by ransomware that locked up computers in hospitals, universities, and private firms, demanding Bitcoin in exchange for files being decrypted. It was able to spread so fast thanks to a Windows flaw weaponized by the U.S. National Security Agency known as EternalBlue, and a back door called DoublePulsar. Sadly, the tools were inadvertently lost and leaked because the NSA considered it wise to stockpile them for future use.
WannaCry was halted by swift work on behalf of dedicated security researchers. But during investigations into the attack, security firm Proofpoint has found that another piece of malware, called Adylkuzz, makes use of the same exploits to spread itself around the word’s insecure Windows devices.
This particular hack has gone unnoticed since April. That’s because unlike WannaCry, which demands attention to get money directly from a user, Adylkuzz simply installs a piece of software and then borrows a PC’s resources. It then sets about mining the little-known cryptocurrency called Monero using your computer. It does so in the background, with users potentially unaware of its presence—though perhaps a little frustrated because their computers are slower than usual.
It makes sense that EternalBlue and DoublePulsar are being used in this way, said Nolen Scaife, a security researcher at the University of Florida. The combination of exploits allows attackers to load just about any type of malware they want onto compromised machines. “It's important to stress that it could be anything—it could be keyloggers, for example,” he told MIT Technology Review. “But what we're seeing is that attackers are using this wherever this makes the most money.”
Interestingly, though, it’s the attack that has until now gone unnoticed that has secured the most loot. WannaCry’s attempt to extort cash in return for unlocking encrypted files has only drummed up $80,000 at the time of writing—probably because Bitcoin, the currency WannaCry’s perpetrators are demanding, is hard to use. Meanwhile one estimate suggests that the Adylkuzz attack could have already raised as much as $1 million.
In some sense, Adylkuzz is less problematic than WannaCry. It’s certainly less overtly destructive. But it does raise a more pressing cause for concern: if it’s been running since April, how many other leaked NSA tools have been used to carry out attacks that have so far gone unnoticed? Stay tuned—there may be more to come.
(Read more: Proofpoint, Reuters, “The WannaCry Ransomware Attack Could’ve Been a Lot Worse,” “Security Experts Agree: The NSA Was Hacked,” “Should the Government Keep Stockpiling Software Bugs?”)
Keep Reading
Most Popular

Why China is still obsessed with disinfecting everything
Most public health bodies dealing with covid have long since moved on from the idea of surface transmission. China’s didn’t—and that helps it control the narrative about the disease’s origins and danger.

Anti-aging drugs are being tested as a way to treat covid
Drugs that rejuvenate our immune systems and make us biologically younger could help protect us from the disease’s worst effects.

These materials were meant to revolutionize the solar industry. Why hasn’t it happened?
Perovskites are promising, but real-world conditions have held them back.

A quick guide to the most important AI law you’ve never heard of
The European Union is planning new legislation aimed at curbing the worst harms associated with artificial intelligence.
Stay connected

Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.