Mirai IoT Botnet Attempts Incursion into Bitcoin

Experts have discovered a module in the Mirai botnet that can mine bitcoins on hacked connected objects. A feature quickly gone.

A team at the IBM X-Force security lab discovered a special feature at the end of March in a variant of the Mirai botnet. This is a bitcoin mining module. This function is at the heart of cryptocurrency. The system uses the computing power of CPUs and terminal GPUs to perform mathematical operations to secure bitcoin transactions.

The module discovered had the ambition to use the computing power of hosts infected by Mirai to mine bitcoins. But this power is relatively limited because the compromised devices are IP cameras, routers or DVR (digital recorders), not having high performance chips.
Stealth function lack of performance

Is this the reason why this bitcoin mining module has disappeared? In any case, the security experts have observed the presence of this function between March 20 and 27, 2017. It has since been withdrawn. Experts believe that this module was an experiment and that, in the face of low performance of connected objects, the creator decided not to continue in this way.

With the opening of the Mirai IoT botnet code at the end of October 2016, dozens of malware variants appeared. But none included features dedicated to bitcoin mining. The iteration discovered by IBM experts focused on devices running on BusyBox in 64-bit version and vulnerable to vulnerabilities in Telnet. In their analyzes, IBM researchers went back to a web console hosted in China.
Stay on the DDoS

This incursion into the bitcoin ecosystem shows that cybercriminals are looking to make the Mirai botnet more profitable. This and its variants are usually used to conduct violent denial of service attacks. The strike force is particularly impressive as shown by the offensives conducted against the provider DNS Dyn, the host OVH or Liberia.

And profitability is at the rendezvous by declining the DDoS mode 'as a service'. Mirai has also given the idea to other malware developers to take an interest in IoT. Last week, Radware unearthed BrickerBot, a software that can destroy connected objects.