About a week ago, the administrators of the website for the Khabarovsk region of Russia received complaints about high computing resource usage from visitors. As soon as they visited the site, their CPUs mysteriously started working at full blast.
“During the investigation, it was found that a mechanism was introduced to the site wherein a malicious program began to work on the user’s computer from a third-party infected site, mining cryptocurrency,” said Vyacheslav Kovalenko, an employee of the administrative support department. This cryptojacking event marks one of the first times that a Russian state website has fallen victim to such an attack.
Though precise details are lacking, this seems to be a typical Coinhive script injection favored among hackers who want to use visitors’ computers to mine Monero. Under such an attack, the website’s owner doesn’t notice much. This is, after all, a client-side script, executed in the visiting browser, not the server.
Instead, the visitors are the ones who get the brunt of the attack, with a noticeable spike in CPU usage and sometimes—in older systems—a long delay between user input and its execution, forcing the user to restart the computer.
As far as cryptojacking incidents go, this wasn’t anything impressive. Being in a sparsely-populated area of eastern Russia, the Khabarovsk website only gets about 600 visits a day.
In December last year, almost a billion visitors per month were hit by cryptojacking on four highly-frequented streaming websites. Because visitors often stay on one page for much longer in these types of sites, the potential profit from this type of attack was over $325,000 per month.
By comparison, we estimate that the hackers who infiltrated the Khabarovsk website would have gotten a maximum of $650 during a one-month period.
This article appeared first on Cryptovest