Rival cryptomining gangs warring over unsecure Linux servers

Pacha Group’s malware goes toe-to-toe with Rocke for maximum computing power to launch mining attacks

Image of a fighter getting ready for a boxing match

A cryptocurrency mining group is "aggressively" targeting a key rival as it attempts to gain a greater foothold on cloud-based environments as a platform for launching more effective attacks.

Researchers have learned that Pacha Group, discovered only in February, is targeting Linux servers on a broader scale, suggesting cloud-based environments are increasingly becoming a target for malicious actors.

Advertisement - Article continues below

But these cyber criminals are also targeting rival cryptocurrency mining groups; specifically channelling efforts into disrupting the operations of a similar collective known as Rocke Group. The latter is also known to target cloud environments.

The main malware infrastructure used by Pacha Group appears to be identical to previous campaigns, although there's a "distinguishable effort" to detect and mitigate Rocke Group implants, according to Intezer.

Rocke is one of the most prominent cryptocurrency mining outfits and has run a variety of campaigns in previous months, most recently targeting Linux servers with mutatable malware in January.

Pacha, by comparison, is smaller and newer, active since September 2018, but far more aggressive. Its malware strain, dubbed Linux.GreedyAntd, uses a variety of techniques to disable or eliminate other strains implanted by rival groups on infected servers. The wider aim is to gain the largest foothold of computing power possible for cryptomining activities.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"We have presented evidence that Pacha Group is targeting cloud-based environments and being especially aggressive towards Rocke Group," said security researcher Nacho Sanmillan.

"We have based this conclusion on the process blacklist used by Pacha Group and the newly added IP blacklist which contains Rocke Group correlated artefacts.

"We have also provided a YARA rule in order to detect Pacha Group's Linux.GreedyAntd implants based on reused code among the implants are attempting to displace each other."

Intezer researchers added that while threats to cloud infrastructure are increasing, detection rates of Linux-based malware remains low. The security industry, the firm added, must do more collectively to effectively mitigate these threats.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Putting a spotlight on cyber security

An examination of the current cyber security landscape

Download now

The economics of infrastructure scalability

Find the most cost-effective and least risky way to scale

Download now

IT operations overload hinders digital transformation

Clearing the path towards a modernised system of agreement

Download now
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/business/policy-legislation/356215/senators-propose-a-bill-aimed-at-ending-warrant-proof-encryption
Policy & legislation

Senators propose a bill aimed at ending warrant-proof encryption

24 Jun 2020

Most Popular

Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/security/vulnerability/356295/microsoft-patches-high-risk-flaws-that-can-be-exploited-with-a
vulnerability

Microsoft releases urgent patch for high-risk Windows 10 flaws

1 Jul 2020
Visit/security/34616/the-top-password-cracking-techniques-used-by-hackers
Security

The top 12 password-cracking techniques used by hackers

12 Jun 2020