![image.png](https://res.cloudinary.com/hpiynhbhq/image/upload/v1520313864/vm42yxivgfjao16bcfnd.png)

Crypto-world is becoming a perfect place for cybercriminals, ranging from theft of digital currency to the latest trend - the illegal installation of software for the extraction of digital currencies. Most often, cybercriminals use Monero's mining software. Potential targets are almost all devices. The worst part? Infected people often do not know they were hacked. There are no ransoms, stolen passwords or personal information.

In 2017, a hacking group called Shadow Brokers released malware called EternalBlue, which was developed by the National Security Agency (NSA), which made it easier to infect Microsoft Windows operating systems.

One of the reasons for cybercriminals to opt for digital currency extraction is that Ransomware attacks have become quite popular, and as a result, cybersecurity developers have released protection for such attacks on the market. Ryan Olson, director of malware research at Palo Alto Networks, said:

"What we see in a near and potentially long-term perspective is the value of a computer that has only a simple processor, maybe it's good to let it get a digital currency rather than being infected with Ransomware or other software that they could to steal data. "

The Talos team explains:

"In this new" business model, "hackers no longer punish their victims for opening an attached or running script, then demanding a ransom. Now, hackers are actively using the resources of infected machines to extract the digital currency. "

### Botnet
A large number of compromised devices working together are known as botnets. Botnets are often used by hackers, as they can be monetized in quite a variety of ways, such as paid DDos and various other attacks that require huge amounts of coordinated power.

In the case of illicit extraction of digital currency, each "node" works independently of others. Cybercriminals just need to install many separate but connected compromised devices. This is because each infected device generates a small profit for hackers.
Sample case: Smominru uses the local EternalBlue NSA exploit directed at Windows users. Hackers typically use phishing attacks with a Microsoft Word attachment. Once the victim downloads the file, it runs a macro in Word that executes a script in Visual Basic, which in turn runs a Microsoft PowerShell script that downloads and installs the extraction software.

### Monero
The most common crypto that is produced in this way is Monero. Sandiff Oliver, a cybersecurity researcher for Proofpoint, commented;

>"Fortune's alternatives such as Monero and Eterium continue their overall trend towards value growth."

Kevin Epstein, vice president of the Center for Operations against Threats at Proofpoint, said:

"This production of Monero through botnet networks is extremely large, composed mainly of servers running Microsoft Windows operating system."

image source - Instagram