How AI caught hackers crypto-mining on a biometric access server in an empty office

Max Heinemeyer, Director of Threat Hunting | Thursday September 10, 2020

Darktrace recently detected a crypto-mining campaign that used the processing power of a corporate server to mine cryptocurrency at a manufacturing firm based in APAC. This server was in control of biometric door access within the client’s office and first downloaded a suspicious executable before beginning to mine for cryptocurrency. This occurred while the firm’s physical office was closed, with all employees working remotely due to COVID-19.

External-facing servers often face increased risk of compromise due to frequent touchpoints with the internet. It is vital that security teams are made aware of malicious activity on these devices as quickly as possible given their role in managing various business operations. Crypto-mining is difficult for many security tools to detect, particularly due to encrypted communications, and can go undetected on servers for long periods of time, slowing or damaging business operations.

Armed with an understanding of ‘normal’ for this manufacturing firm Darktrace’s AI was able to recognize the anomalous behavior, and the Cyber AI Analyst launched a fully autonomous investigation into the incident.

Figure 1: A timeline of the attack

The first signs of compromise

Darktrace identified an internet-facing server downloading a suspicious executable file, Securitcy.111, from a new external IP that had never been seen on the network before. The server had RDP, SMB, and SQL ports open externally – a successful incoming SQL connection from the external IP was seen shortly before the file download, suggesting a likely source of compromise. Successful RDP and SMB version 1 connections were also seen around the time of this activity.

Following this file download, the server began to repeatedly connect to external endpoints using self-signed TLS certificates. These endpoints are associated with mining pools for the digital currency Monero.

Darktrace’s detection

Despite a lack of threat intelligence on the external source of the file download, Darktrace’s AI easily detected that this behaviour was highly unusual, alerting the firm to the serious emerging incident and enabling the customer to quickly take action. Instead of relying on known IoCs, the crypto-mining connections were immediately identified by Darktrace as suspicious due to their use of self-signed TLS certificates, alongside the statistical rarity of the endpoints for the business.

The new user agent was generic, and commonly associated with legitimate and malicious processes alike. This use of user agents means that C2 communication is less likely to be detected by the traditional security stack, however its unusual use was immediately flagged by Darktrace as suspicious.

AI Analyst coverage

Darktrace’s Cyber AI Analyst investigated this crypto-mining incident, providing an immediate indication that the device had been compromised.

Figure 2: Screenshot of AI Analyst detection of the crypto-mining

The below image shows the infected device over the same five-day period, with model breaches represented by dots and color indicating severity. The clear increase in model breaches on the device during this activity is a clear indication of compromise.

Figure 3: A graph showing a large increase in models breached by the device on 3 June

Figure 4: A sample of models breached by the server at the time of this compromise

As thousands of organizations moved to remote working this year – with the questions of when, how, and whether to return still unanswered – it is critical to ensure that physical IT infrastructure within offices remains secure. Internet-facing servers in particular must be able to withstand a multitude of external threats. This incident demonstrates the importance of security tools that can not only detect known IoCs, but emerging and unknown incidents.

Darktrace’s AI-powered approach was able to immediately detect the suspicious behavior and identify the compromise. Thanks to Darktrace’s quick detection, and the investigation of the Cyber AI Analyst, the client could remediate the crypto-mining infection.

Thanks to Darktrace analyst Emma Foulger for her insights on the above threat find.

Learn more about Cyber AI Analyst

IoCs:

IoCComment
185.170.210[.]59Download of payload
URI:
/img/zhu/Securitcy.111
File hashes:
548022246f3c76c8c79ee762fe7e0050a0cf8396,
e809a00daa7c18fd5101e8516435575c219709d4
107.178.104[.]10
39.99.124[.]170
139.99.123[.]196
139.99.125[.]38
192.110.160[.]114
Pool-hk.supportxmr[.]com
Monero mining destinations

Darktrace model detections:

  • Anomalous File / Masqueraded File Transfer
  • Anomalous File / Internet Facing System File Download
  • Anomalous File / EXE from Rare External Location
  • Anomalous Connection / Rare External SSL Self-Signed
  • Device / Anomalous SMB Followed By Multiple Model Breaches
  • Device / Anomalous RDP Followed By Multiple Model Breaches
  • Anomalous File / Multiple EXE from Rare External Locations
  • Anomalous Connection / New User Agent to IP Without Hostname
  • Device / Initial Breach Chain Compromise
  • Compromise / Monero Mining
  • Compromise / Uncommon Monero Mining

Max Heinemeyer

Max is a cyber security expert with over nine years’ experience in the field, specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats, as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. In this role he worked as a white hat hacker, leading penetration tests and red team engagements. He was also part of the German Chaos Computer Club when he was still living in Germany. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.