PageSourceSearch

https://cyber-threat-intelligence.com/research/cryptojacking/

html cyber-threat-intelligence.com collected 2026-09-29 12:33:12 UTC 24,428 bytes, 428 lines download raw bytes

1
2
3<!DOCTYPE html>
4<html>
5
6	<head>
7
8		<!-- Basic -->
9		<meta charset="utf-8">
10		<meta http-equiv="X-UA-Compatible" content="IE=edge">	
11
12		<title>Investigating Cryptojacking Campaigns on the Web</title>	
13
14		<meta name="keywords" content="cryptojacking, campaign analysis, menero, cyber threat intelligence" />
15		<meta name="description" content="Cyber criminals are able to earn money by using your computer, without anything on your computer and without you being aware of it. In this research, we have found attackers deploying large cryptojacking campaigns spread over numerous websites exploiting their visitors for illicit cryptomining">
16		<meta name="author" content="Hugo Bijmans">
17
18		<!-- Favicon -->
19		<link rel="shortcut icon" href="img/favicon.ico" type="image/x-icon" />
20		<link rel="apple-touch-icon" href="img/apple-touch-icon.png">
21
22		<!-- Mobile Metas -->
23		<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1.0, shrink-to-fit=no">
24
25		<!-- Web Fonts  -->
26                <link href="/css/OpenSans.css" rel="stylesheet" type="text/css">
27
28		<!-- Vendor CSS -->
29		<link rel="stylesheet" href="/vendor/bootstrap/css/bootstrap.min.css">
30		<link rel="stylesheet" href="/vendor/font-awesome/css/fontawesome-all.min.css">
31		<link rel="stylesheet" href="/vendor/animate/animate.min.css">
32		<link rel="stylesheet" href="/vendor/simple-line-icons/css/simple-line-icons.min.css">
33		<link rel="stylesheet" href="/vendor/owl.carousel/assets/owl.carousel.min.css">
34		<link rel="stylesheet" href="/vendor/owl.carousel/assets/owl.theme.default.min.css">
35		<link rel="stylesheet" href="/vendor/magnific-popup/magnific-popup.min.css">
36
37		<!-- Theme CSS -->
38		<link rel="stylesheet" href="/css/theme.css">
39		<link rel="stylesheet" href="/css/theme-elements.css">
40		<link rel="stylesheet" href="/css/theme-blog.css">
41		<link rel="stylesheet" href="/css/theme-shop.css">
42
43		<!-- Current Page CSS -->
44		<link rel="stylesheet" href="/vendor/rs-plugin/css/settings.css">
45		<link rel="stylesheet" href="/vendor/rs-plugin/css/layers.css">
46		<link rel="stylesheet" href="/vendor/rs-plugin/css/navigation.css">
47		
48		<!-- Demo CSS -->
49
50
51		<!-- Skin CSS -->
52    <link rel="stylesheet" href="/css/skins/skin-hpi.css">
53
54		<!-- Theme Custom CSS -->
55    <link rel="stylesheet" href="/css/custom.css">
56
57		<!-- Head Libs -->
58    
58<script src="/vendor/modernizr/modernizr.min.js"></script>
58
59        
60        
60<script src="/js/jquery.min.js"></script>
60  
61        
61<script language="javascript">
62            jQuery(document).ready(function(){
63                jQuery('.biburl').click(function( e ){
64                    // Preven loading new page
65                    e.preventDefault();
66                    var currentDiv = jQuery(this).parent();
67
68                    
69                    if (currentDiv.find(".bibtexentry").length > 0) {
70                        currentDiv.find(".bibtexentry").toggle("fold");
71                        
72                    } else {
73                    
74                    
75                    // Get the HTML of the bib entry
76                    $.ajax({
77                        url: jQuery(this).attr('href'),
78                        dataType: 'html'
79                    })
80                    .done(function( data ) {
81                            var bitexentry = jQuery(data).find('.purebibtex').html();
82                            currentDiv.append('<blockquote class="with-borders bibtexentry" style="margin-top:15px; display:none;"><pre>' + bitexentry + '</pre></blockquote>');
83                            currentDiv.find(".bibtexentry").toggle("fold");
84                        });
85                    
86                    //alert(jQuery(this).attr('href'));//return associated link.
87                }
88                });
89            })
90        </script>
90
91
92	</head>
93	
94<body>
95   
96    
97<div class="body">
98<header id="header" class="header-narrow" data-plugin-options="{'stickyEnabled': true, 'stickyEnableOnBoxed': true, 'stickyEnableOnMobile': true, 'stickyStartAt': 57, 'stickySetTop': '-55px', 'stickyChangeLogo': false}">
99	<div class="header-body">
100		<div class="header-container container">
101			<div class="header-row">
102				<div class="header-column">
103					<div class="header-row">
104						<div class="header-logo">
105							<a href="/"><img alt="CTI-Lab" height="42" src="/img/man-head-silhouette.png" style="margin-right:10px"></a>
106                                                        <a href="https://www.hpi.de">
107                                                                <img alt="CTI-Lab" height="62" src="/img/hpi-logo.jpg">
108                                                        </a>
109						</div>
110					</div>
111				</div>
112				<div class="header-column justify-content-end">
113					<div class="header-row">
114
115
116                        <div class="header-nav">
117    <div class="header-nav-main header-nav-main-effect-1 header-nav-main-sub-effect-1">
118        <nav class="collapse">
119            <ul class="nav nav-pills" id="mainNav">
120	            <li class="">
121		            <a class="" href="/">
122			            Home
123		            </a>
124	            </li>
125	            <li class="dropdown">
126		            <a class="dropdown-item dropdown-toggle" href="#">Research Projects</a>
127		            <ul class="dropdown-menu">
128                        	<span class="dropdown-title" style="font-size:0.8em; margin-left:5px;">Featured Research</span>
129			        <li>
130						<a class="dropdown-item" href="/research/agentic-ai-skill-awareness/">Security Awareness in the Agentic AI Skill Ecosystem</a>
131						<a class="dropdown-item" href="/research/municipal-cti/">Kommunale IT-Sicherheit</a>
132						<a class="dropdown-item" href="/research/cryptojacking/">Crytojacking - malicious, invisible exploitation of website visitors</a>
133						<a class="dropdown-item" href="/research/cerber-cnc/">Criminals use the blockchain for coordination of ransomware</a>
134						<a class="dropdown-item" href="/research/memcached-copycats/">An Analysis of the memcached DDoS on github.com</a>
135						<!-- <a class="dropdown-item" href="/research/fingerprinting-tools/">Fingerprinting high-performance port scanners</a> -->
136						<a class="dropdown-item" href="/research/supply-chain/">Securing the Global Supply Chain</a>
137			         </li>
138		            </ul>
139	            </li>
140	            <li class="">
141		            <a class="nav-link" href="/publications/">
142			            Publications
143		            </a>
144	            </li>
145	            <li class="">
146		            <a class="nav-link" href="/people/">
147			            People
148		            </a>
149	            </li>
150	            <li class="dropdown">
151		            <a class="dropdown-item dropdown-toggle" href="/education/">Education</a>
152		            <ul class="dropdown-menu">
153			            <li>
154				            <a class="dropdown-item" href="/education/netzwerksicherheit/">Network Security</a>
155				            <a class="dropdown-item" href="/education/cyber-security-management/">Cyber Security Management</a>
156				            <a class="dropdown-item" href="https://hpi.de/studium/lehrveranstaltungen/it-systems-engineering-ma/lehrveranstaltung/wise-20-21-3076-cyber-threat-intelligence.html">Cyber Threat Intelligence</a>
157			            </li>
158
159		            </ul>
160	            </li>
161	            <li class="">
162		            <a class="" href="/blog/">
163			            Blog
164		            </a>
165	            </li>	      
166            </ul>
167        </nav>
168    </div>
169    <ul class="header-social-icons social-icons d-none d-sm-block">
170        <li class="social-icons-twitter"><a href="https://twitter.com/cyberthreatlab" target="_blank" title="Twitter"><i class="fab fa-twitter"></i></a></li>
171        <li class="social-icons-linkedin"><a href="https://www.linkedin.com/in/christian-doerr-9a5306b" target="_blank" title="Linkedin"><i class="fab fa-linkedin-in"></i></a></li>
172    </ul>
173    <button class="btn header-btn-collapse-nav" data-toggle="collapse" data-target=".header-nav-main nav">
174        <i class="fas fa-bars"></i>
175    </button>
176</div>
177 
178
179						
180					</div>
181				</div>
182			</div>
183		</div>
184	</div>
185</header>
186<img src="https://data.cyber-threat-intelligence.com/piwik.php?idsite=1&amp;rec=1" style="border:0" alt="" />
187
188
189			<div role="main" class="main">
190
191				<section class="page-header custom-product">
192					<div class="container">
193						<div class="row">
194							<div class="col-md-12">
195								<ul class="breadcrumb breadcrumb-white">
196									<li><a href="/">Home</a></li>
197									<li style="color:black">Research Projects</li>
198								</ul>
199							</div>
200						</div>
201
202						<div class="row">
203							<div class="col-sm-10">
204								<h1>Cryptojacking - Malicious, invisible exploitation of website visitors</strong></h1>
205								<p class="lead">Cyber criminals are able to earn money by using your computer, without you installing anything on your computer and without you being aware of it. In this research, we are reporting on attackers deploying large cryptojacking campaigns spread over numerous websites exploiting their visitors for illicit cryptomining<br/> 
206</p>
207							</div>
208						</div>
209					</div>
210				</section>
211
212
213				<div class="container">
214
215					<div class="row">
216						<div class="col-md-6">
217							<h2>What is Cryptojacking?</h2>
218								<p>
219	Cryptocurrency -- such as Bitcoin, Ethereum or Monero -- is mined by computers solving a cryptographic puzzle, which gets increasingly difficult over time. With the increasing popularity of Bitcoin, so many people started mining using their computer that this was no longer was profitable to do, so people turned to mining bitcoin using their graphics cards. By now, this type of mining is also no longer effective and professional bitcoin miners are relying on custom-made chips to create coins.<br/>
220	As Bitcoin mining cannot be efficiently done anymore using regular hardware, a lot of alternative cryptocurrencies have sprung up over the past years, which modified the way mining is done. One of them is Monero, which uses a different type of cryptographic puzzle that is well suited for normal PCs but cannot be efficiently parallelized using specialized hardware. Thus in order to obtain Monero at scale, you will need access to a lot of computers.
221	<br/>
222								</p>
223							</div>
224							<div class="col-md-6">
225									<br/><br/>
226									<img src="/research/cryptojacking/cryptojacking.jpg" width="450px"><br/>
227									<font size=1>Image: <a href="https://foto.wuestenigel.com/man-mining-crytocurrency/?utm_source=40289270313&utm_campaign=FlickrDescription&utm_medium=link" rel="nofollow">Marco Verch</a>, CC 2.0</font>
228							</div>
229						</div>
230
231					<div class="row">
232						<div class="col-md-12">
233	In 2017, a company called Coinhive developed a method to do cryptomining within a web browser. This works with the help of WebAssembly, highly optimized machine code, and a JavaScript library. Using this setup, anyone can deploy cryptomining into a websites within 5 minutes of work, and every user that visits this particular site will generate some tiny profit using their webbrowser for the owner of the website.
234<br/><br/>
235
236		These new cryptocurrencies and web-based mining have also attracted the attention of cyber criminals. Over the past 18 months, criminals have begun to systematically hack websites and compromise software, and embed these scripts so that they can earn a profit from unsuspecting users. When cryptomining is done without knowledge and consent of the user, we refer to it as <i>cryptojacking</i>.
237		The Cyber Threat Intelligence Lab has investigated the use and scale of such cryptomining scripts by cyber criminals among 55 million web pages, and we have found hundreds of actors exploiting the attack vector in a coordinated fashion. In this blog post, we highlight a number of key findings of our research. Please refer to the <a href="/publications/Usenix2019-cryptojacking.pdf" target="_new">full paper</a> if you want to know more about this research.
238<br/><br/>
239							</div>
240						</div>
241
242<!-- video, pirate bay -->
243
244					<div class="row">
245						<div class="col-md-12">
246							<br/><br/><h2>Cryptojacking Prevelance</h2>
247							<p>
248In order to see how widespread the problem is and how these attacks are deployed in practice, we need to measure a large part of the Internet. While often Internet surveys are done using top lists such as the Alexa Top 1 Million -- a directory of the one million most popular websites on the Internet --, this will not create a true insight into the problem. As cryptojacking is more profitable the more people visit the website, you would expect websites ranking at the top to be over-proportionally engaging in this practice. Instead of compromising a single large website, you could also diversify and target hundreds of different ones, so your earnings are more robust if owners spot the compromise and remove it.<br/><br/>
249We built a crawler to detect cryptojacking and analyze how it was deployed on a particular site. With this system, we go through two parts of the Internet, first we visit the top websites according to Alexa, Majestic and Cisco, and second, we visit 20% of all websites of the Internet, randomly sampled from 1136 top-level domains such as .com, .org etc. Over a period of 3 months, 720 of our crawlers visited 55 million websites and followed those which were infected with cryptojacking.
250							</p>
251						</div>
252					</div>
253					<div class="row">
254				
255						<div class="col-md-6">
256							<p>
257								Indeed cryptojacking is much more widespread across the most visited parts of the Internet -- about 0.06% of all websites in the Alexa Top 1 million engage in this practice --, as it is much more profitable to do it there. The likelihood to find cryptojacking here is approximately 5 times as large as in the Internet as a whole.
258
259While across the entire Internet only 0.011% of all websites were actively cryptojacking during our study period, there is a large difference between the various top-level domains. When you visit a Russian and Brazilian domain, the change to find cryptojacking is five times as high than for example on a German domain or .com in general. Different c
259ountries also have clear preferences for the type of providers they choose when doing cryptojacking.
260							</p>
261						</div>
262						<div class="col-md-6">
263								<br/><br/>
264								<img src="/research/cryptojacking/tldcomparison.png" width="550px">
265						</div>
266					</div>
267
268					<div class="row">
269						<div class="col-md-12">
270						<br/><br/>
271						<h2>Organized Campaigns are Widespread</h2>
272							<p>
273While infecting a major website such as amazon.com with cryptojacking would create a lot of earnings, it would probably also get very soon be noticed. Another strategy is thus to target a large number of websites, each with a few visitors, and thus make money through volume.
274If you would be targeting hundreds of websites, it is however impractical to setup hundreds of Monero accounts and deploy different attack scripts and supporting infrastructure for each website. Instead, it is much easier to channel all money through just a few accounts, and reuse the Javascript files required for cryptojacking across the individual sites.
275<br/><br/>
276
277When criminals take this easy route, this will also allow us to group those websites together which are under the control by the criminal. When the cryptojacking on two websites sends the earnings to the same account or both are using the same proxy server for their activity, we can link them as related. In our crawler, we perform this type of analysis across a number of dimensions, including how the cryptomining code is implanted into the website and how it is being called, a so-called stack trace.
278<br/><br/>
279We discovered the existence of 204 cryptojacking campaigns, ranging from just a few compromise websites to gigantic installations involving up to 987 websites in a single campaign all generating money for the same actor. By both manual and computer-assisted stack trace analysis we found out that most of these cryptojacking campaigns were the result of the abuse of vulnerabilities within the 
280third-party Web software ecosytem. We have seen crimininals installing cryptojacking scripts on a large number of websites running an out-dated version of WordPress, and we found websites to be using pirated version of premium WordPress themes which are accompanied by a cryptominer script. By spreading such scripts through pirated copies 
281of premium WordPress themes, attackers were able to infect almost a 1000 websites with the same infection.
282							</p>
283
284							<img src="/research/cryptojacking/jquory.png" width="750px">
285							<br/><br/><br/>
286						</div>
287					</div>
288
289					<div class="row">
290						<div class="col-md-4">
291							<p>
292Not just WordPress is abused by these cyber criminals, also Bitrix24, a CRM system used by a large number of campanies all over the world has been a victim of this attack.
293A maliciouos file, disguised as the Bitrix24 core loader, contains a number of different miner scripts which are randomly chosen upon visit. The infection even included 
294an evasion technique, which stops all mining operations happening on the website once the Developer Tools window is opened.
295							</p>
296						</div>
297						<div class="col-md-8">
298								<img src="/research/cryptojacking/bitrix24.png" width="640px">
299						</div>
300					</div>
301
302
303					<div class="row">
304						<div class="col-md-12">
305							<br/><br/><h2>Third-Party Software is the Most Common Attack Vector</h2>
306						</div>
307						<div class="col-md-5">
308								<img src="/research/cryptojacking/attackvectors.png" width="460px">
309						</div>
310						<div class="col-md-7">
311							<p>	
312By looking at all these campaigns, we noticed that attacks like these were responsible for a large share of cryptojacking in the Internet. In fact, when we trace how a website got infected, almost 60% of all cryptojacking infections among the identified campaigns are the result of a compromise of some third-party software, such as a content management system plugin, a (pirated) template, or a hosted library. 
313Less than 30% of all infections are the result of a (regular) hacked website, and less than 15% is put up by website owners themselves. While we frequently hear about malware infections due to malicious advertisements, this attack vector is only vanishingly small with respect to cryptojacking.<br/><br/>
314
315This surprising distribution is noteworthy in two respects: first, it again shows that the "popular parts" of the Internet -- facebook, google, amazon and so on -- and structually very different from the Internet at large. 
316							</p>
317						</div>
318						<div class="col-md-12">
319							<p>
320Across these top sites, we do not find content management systems such as Wordpress or Joomla, with outdated installations and plugins, pirated templates and externally hosted code which is abused through these campaigns, however in the general Internet we do.
321Second, the findings highlight that we are not doing great in securing today's software ecosystem, which are highly entangled and getting increasingly complex, and better steps are needed to secure modular ecosystems such as marketplaces with add-ons, plugins and other external 
321components, so that users can be certain on what code is actually running.
322
323
324
325							</p>
326						</div>
327					</div>
328					
329					<br/>	
330					<div class="feature-box feature-box-style-6">
331						<div class="feature-box-icon">
332							<i class="fas fa-file"></i>
333						</div>
334						<div class="feature-box-info">
335							<h4 class="mb-2">Downloads</h4>
336							<p class="mb-4">You can read more about our analysis of cryptojacking in our report below:<br/>
337								<a href="/publications/Usenix2019-cryptojacking.pdf" target="_new">Hugo L.J. Bijmans, Tim M. Booij and Christian Doerr, Inadvertently making Cyber Criminals Rich: A Comprehensive Study of Cryptojacking Campaigns at Internet Scale, Usenix Security Symposium 2019 [pdf]</a></p>
338						</div>
339					</div>
340
341				</div>
342
343
344\</div>
345			<footer id="footer">
346				<div class="container">
347					<div class="row">
348						<div class="footer-ribbon">
349							<span>Get in Touch</span>
350						</div>
351						<div class="col-lg-3">
352							<h4>Latest Tweets</h4>
353							<div id="tweet" class="twitter" data-plugin-tweets data-plugin-options="{'username': 'cyberthreatlab', 'count': 2}">
354								<p>Please wait...</p>
355							</div>
356						</div>
357						<div class="col-lg-5">
358							<div class="contact-details">
359								<h4>Visiting Address</h4>
360								<ul class="contact">
361                                                                        <li><p><i class="fas fa-map-marker-alt"></i>Hasso Plattner Institute, Rudolf-Breitscheid-Straße 187-189, 14482 Potsdam, Germany</p></li>
362								</ul>
363							</div>
364						</div>
365						<div class="col-lg-2">
366							<h4>Follow Us</h4>
367							<ul class="social-icons">
368								<li class="social-icons-twitter"><a href="https://twitter.com/cyberthreatlab" target="_blank" title="Twitter"><i class="fab fa-twitter"></i></a></li>
369								<li class="social-icons-linkedin"><a href="https://www.linkedin.com/in/christian-doerr-9a5306b" target="_blank" title="Linkedin"><i class="fab fa-linkedin-in"></i></a></li>
370							</ul>
371						</div>
372					</div>
373				</div>
374				<div class="footer-copyright">
375					<div class="container">
376						<div class="row">
377							<div class="col-lg-7">
378								<p>© Copyright 2018-20. All Rights Reserved. <a href="https://www.cyber-threat-intelligence.com/imprint.php">Imprint and Data Privacy</a></p> 
379							</div>
380						</div>
381					</div>
382				</div>
383			</footer>
384		</div>
385		<!-- Vendor -->
386		
386<script src="https://www.cyber-threat-intelligence.com/vendor/jquery/jquery.min.js"></script>
386
387		
387<script src="https://www.cyber-threat-intelligence.com/vendor/jquery.appear/jquery.appear.min.js"></script>
387
388		
388<script src="https://www.cyber-threat-intelligence.com/vendor/jquery.easing/jquery.easing.min.js"></script>
388
389		
389<script src="https://www.cyber-threat-intelligence.com/vendor/jquery-cookie/jquery-cookie.min.js"></script>
389
390		
390<script src="https://www.cyber-threat-intelligence.com/vendor/popper/umd/popper.min.js"></script>
390
391		
391<script src="https://www.cyber-threat-intelligence.com/vendor/bootstrap/js/bootstrap.min.js"></script>
391
392		
392<script src="https://www.cyber-threat-intelligence.com/vendor/common/common.min.js"></script>
392
393		
393<script src="https://www.cyber-threat-intelligence.com/vendor/jquery.validation/jquery.validation.min.js"></script>
393
394		
394<script src="https://www.cyber-threat-intelligence.com/vendor/jquery.easy-pie-chart/jquery.easy-pie-chart.min.js"></script>
394
395		
395<script src="https://www.cyber-threat-intelligence.com/vendor/jquery.gmap/jquery.gmap.min.js"></script>
395
396		
396<script src="https://www.cyber-threat-intelligence.com/vendor/jquery.lazyload/jquery.lazyload.min.js"></script>
396
397		
397<script src="https://www.cyber-threat-intelligence.com/vendor/isotope/jquery.isotope.min.js"></script>
397
398		
398<script src="https://www.cyber-threat-intelligence.com/vendor/owl.carousel/owl.carousel.min.js"></script>
398
399		
399<script src="https://www.cyber-threat-intelligence.com/vendor/magnific-popup/jquery.magnific-popup.min.js"></script>
399
400		
400<script src="https://www.cyber-threat-intelligence.com/vendor/vide/vide.min.js"></script>
400
401		
402		<!-- Theme Base, Components and Settings -->
403		
403<script src="https://www.cyber-threat-intelligence.com/js/theme.js"></script>
403
404		
405		<!-- Current Page Vendor and Views -->
406		
406<script src="https://www.cyber-threat-intelligence.com/vendor/rs-plugin/js/jquery.themepunch.tools.min.js"></script>
406
407		
407<script src="https://www.cyber-threat-intelligence.com/vendor/rs-plugin/js/jquery.themepunch.revolution.min.js"></script>
407
408		
409		<!-- Theme Custom -->
410		
410<script src="https://www.cyber-threat-intelligence.com/js/custom.js"></script>
410
411		
412		<!-- Theme Initialization Files -->
413		
413<script src="https://www.cyber-threat-intelligence.com/js/theme.init.js"></script>
413
414
415		<!-- Google Analytics: Change UA-XXXXX-X to be your site's ID. Go to http://www.google.com/analytics/ for more information.
416		
416<script>
vendor: 346 bytes, lines 416-422
416
417			(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
418			(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
419			m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
420			})(window,document,'script','//www.google-analytics.com/analytics.js','ga');
421		
422			ga('create', '
422UA-12345678-1
vendor: 41 bytes, lines 422-424
422', 'auto');
423			ga('send', 'pageview');
424		
424</script>
424
425		 -->
426
427	</body>
428</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.