CoinStomp Malware is Aimed at Asian Cloud Service Providers

This article has been indexed from

CySecurity News – Latest Information Security and Hacking Incidents

Researchers have uncovered a new malware family that mines cryptocurrencies using cloud services. According to Cado Security, the malware, dubbed CoinStomp, is comprised of shell scripts that “try to target cloud compute instances hosted by cloud service providers for the purpose of mining cryptocurrencies.” According to the company’s researchers, the overall goal of CoinStomp is to silently breach instances in order to harness computational resources to illicitly mine for cryptocurrency, a type of attack known as cryptojacking. 

So far, a handful of attacks have targeted cloud service companies in Asia. Clues in code also referenced Xanthe, a cryptojacking threat group previously linked to the Abcbot botnet. However, the clue – found in a defunct payload URL – is insufficient to determine who is behind CoinStomp and may have been included in an “attempt to dodge attribution,” according to the team. 

CoinStomp includes a variety of intriguing features. One example is its reliance on “timestomping.” Timestomping is the process of modifying the timestamps of files dumped or used during a malware attack. This approach is commonly used as an anti-forensics strategy to confound investigators and thwart remedial efforts. Although the Rocke gang has previously utilized timestomping in cryptojacking assaults, it is not a common technique. On Linux, timestomping is simple with the -t flag of the touch command.