drupal websites are victims to cryptojacking campaigns

Drupal websites are victims to cryptojacking campaigns update#
Drupal websites are victims to cryptojacking campaigns full#
Drupal websites are victims to cryptojacking campaigns software#
Drupal websites are victims to cryptojacking campaigns code#

The domain name vuuwdcom was also used previously in Monero mining operations through mineXMRcom, said Mursch: “While it’s somewhat unusual they’d switch from a mining pool with a 1% fee to Coinhive, who takes a 30% cut of all mining proceeds, it was the choice they made,” he said.ĭrupalgeddon 2.0, which has been patched for over a month now and impacts versions 6,7, and 8 of Drupal’s CMS platform, “potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised,” according to MITRE’s Common Vulnerabilities and Exposures bulletin back on March 28. One of the domains references less-fake information. It's likely you'd find malicious activity tied to these as well. While the clearly fake WHOIS data may seem like a dead end, the same email address was used to register five other domains. However, the email address that was used provided a small hint as it was associated with other registered domains. When trying to nail down the owner of vuuwdcom, Mursch came across fake data from WHOIS indicating that “it belongs to ‘X XYZ’ who lives on ‘joker joker’ street in China,” he explained in a Tweet. As a result victims can sometimes experience overheating of their phone or computer as their device gets bogged down by an over-taxed processor. Typically, cryptojacking attacks are not throttled and use 100 percent of the target’s CPU.

Mursch said that the miner was only slightly throttled so that it had a reduced impact on visitors’ CPUs and would be harder to detect. The site key used, meanwhile, was “KNqo4Celu2Z8VWMM0zfRmeJHIl75wM圆.” Mursch said he confirmed the key was still active by checking in Fiddler. A slightly throttled implementation of Coinhive was found.” Upon visiting the URL, the ugly truth was revealed.

Drupal websites are victims to cryptojacking campaigns code#

“Once the code was deobfuscated, the reference to ‘ was clearly seen. That domain used to inject the malware was vuuwdcom, according to Mursch. Coinhive’s site key is code linked to a unique cryptographic key that delegates who keeps the cryptocurrency that is being mined. Mursch said he was notified by one of his Twitter followers soon after of additional compromised sites using a different payload – however, all the infected sites pointed to the same domain using the same Coinhive site key. “The malicious code was contained in the ‘/misc/?v=1.2’ JavaScript library.” “Digging a little deeper into the cryptojacking campaign, I found in both cases that Coinhive was injected via the same method,” Mursch wrote.

Drupal websites are victims to cryptojacking campaigns software#

The cryptominer in question was made by Coinhive, a company that offers a Monero JavaScript miner to websites as a nontraditional way to monetize website content. Coinhive’s JavaScript miner software is often used by hackers, who secretly embed the code into websites and then mine Monero currency by tapping the CPU processing power of site visitors’ phones, tablets and computers.

It's not an exhaustive list and is subject to change as this #cryptojacking campaign is still ongoing. Sheet has been updated with additional sites. Equal Employment Opportunity Commission (a US federal government agency). Īs of Tuesday evening, Mursch said he has found more websites that were targeted by the attack, including that of Lenovo, UCLA, and Office of Inspector General of the U.S. This #cryptojacking outbreak started at the zoo and quickly spread to 400+ other sites. “Using the bulk scan feature of urlscan.io, it became clear these were all sites were running outdated and vulnerable versions of Drupal content management system.”

Drupal websites are victims to cryptojacking campaigns full#

“After the scan completed, the full scope of this cryptojacking campaign was established,” Mursch wrote in a report posted Saturday. The Drupal bug in questions has been patched for over a month now. The attacks, which have impacted over 400 government and university websites worldwide, leverage the critical remote-code execution vulnerability ( CVE-2018-7600) dubbed Drupalgeddon 2.0, said Troy Mursch, researcher with Bad Packets Report.

Drupal websites are victims to cryptojacking campaigns update#

UPDATE – Hundreds of websites running on the Drupal content management system – including those of the San Diego Zoo and the National Labor Relations Board – have been targeted by a malicious cryptomining campaign taking advantage of unpatched and recently revealed vulnerabilities.