Monero mining malware linked to Turkish telecom company

Turkish Internet provider implicated in recent Monero mining virus epidemic in Middle East, says Citizen Lab in its report
12 March 2018   1049

Recently there was a flood of Windows applications infected with Monero miner in Turkey and Syria. University of Toronto's Citizen Lab took an interest in this case and made a report. The results are surprising, to say the least.

The culprit was connected to to Türk Telekom – a formerly governmental Turkish telecommunications provider. According to the report, the ties to miner virus are connected to an unknown party with the access to provider's middleboxes, associated with government surveillance in Turkey and Syria. All this raises questions whether or not the virus itself is a product of some governmental effort at mining.

The infection scheme, called “AdHose”, is explained further in the report. The users are unknowingly redirected to infected copies of legitimate software while trying to download Windows applications such as Avast Antivirus, Ccleaner, 7-Zip or Opera, for example.

The spokesperson for the Türk Telekom reacted to the accusations and published a stetement, calling Citizen Lab allegations technically inaccurate and intentionally misleading. He also said that the company is currently investigating the issue, because they are “deeply commited to ethical technology development”.

The idea itself of government-controlled cryptocurrency mining malware is a little far-fetched in the expert's opinion, but the similar cases have already been reported by Open Observatory of Network Interference in 2016. At that time the Egyptian internet provider has been implicated in similar MITM-type attacks with malware and advertising present, minus the mining element.

Scammers to Replace MEGA Extension to Steal Crypto

MEGA is a popular file exchange service; scammers were able to replace its official Google Chrom extension
05 September 2018   449

The popular file-sharing service MEGA reported a hacker attack. Attackers managed to replace the official Chromme extension of the service and to collect data on users' crypto-currency wallets.

On 4 September 2018 at 14:30 UTC, an unknown attacker uploaded a trojaned version of MEGA's Chrome extension, version 3.39.4, to the Google Chrome webstore. Upon installation or autoupdate, it would ask for elevated permissions (Read and change all your data on the websites you visit) that MEGA's real extension does not require and would (if permissions were granted) exfiltrate credentials for sites including amazon.com, live.com, github.com, google.com (for webstore login), myetherwallet.com, mymonero.com, idex.market and HTTP POST requests to other sites, to a server located in Ukraine. Note that mega.nz credentials were not being exfiltrated.

MEGA Blog

Thus, attackers could get access to the popular cryptocurrency wallets MyEtherWallet and MyMonero. Also, users' funds on the decentralized IDEX exchange are under the thread too.

Representatives of the file sharing company stressed that the fake extension was replaced by a genuine one four hours after the substitution. And an hour later, Google reacted and removed the extension from the Chrome store. Note that at the time of publication, the MEGA extension for Chrome in the official store is still not available.

Earlier it was reported that users of MyEtherWallet, using the free VPN-plugin Hola, could become victims of a hacker attack.