Security experts from PaloAlto Networks have uncovered a large-scale crypto-currency mining operation active for over 4 months. Experts believe the activity involved around 30 million systems worldwide to mine the Monero cryptocurrency using the open-source XMRig utility.

The threat actors used VBS files and URL shortening services to deploy the mining tool, the most commonly hit countries are Thailand (3,545,437), Vietnam (1,830,065), and Turkey (665,058).

“Palo Alto Networks Unit 42 has observed a large-scale cryptocurrency mining operation that has been active for over 4 months. The operation attempts to mine the Monero cryptocurrency using the open-source XMRig utility,” states PaloAlto networks.

“Based on publicly available telemetry data via bitly, we are able to estimate that the number of victims affected by this operation is roughly around 15 million people worldwide.”

The analysis of data from the Bit.ly URL shortening service revealed that at least 15 million people were impacted by the campaign.

The Monero cryptocurrency mining operation is huge, researchers detected over 250 unique Microsoft Windows PE files, most of them were downloaded from online cloud storage provider 4sync.

The files have generic names and appear to originate from popular looking file-sharing services.

After October 20, 2017, the experts observed attackers started using HTTP redirection services.

Since November 16, 2017, threat actors stopped using the SFX files and adopted executables compiled in Microsoft .NET Framework.

“Beginning on November 16, 2017, the attackers yet again changed tactics regarding their malware. They no longer made use of SFX files, but instead transitioned to using an executable file compiled in Microsoft .NET Framework that would write a VBS file to disk and modify the victim’s Run registry key to ensure persistence.” continues the analysis.

“The last changes we’ve seen took place in late December 2017, when the attackers yet again changed the dropper that was used to deploy the malware. Moving away from .NET, they instead create the necessary VBS file using a dropper compiled with Borland Delphi. Unlike the .NET droppers, this particular dropper will place the VBS file in the victim’s startup folder in order to obtain persistence. Otherwise, the flow of execution remains the same.”

The last samples that were using this dropper referenced a new IP address for XMRig communication( 5.23[.]48[.]207).

“Monero mining campaigns are certainly not a new development, as there have been various reported instances recently. However, it is less common to observe such a large-scale campaign go relatively unnoticed for such a long period of time. ” concluded Palo Alto.