WatchDog Cryptojacking Campaign
Affected platforms
The following platforms are known to be affected:
Windows and Unix-like cloud environments
Threat details
Introduction
WatchDog is a recently discovered cryptojacking campaign that mainly targets Windows and Unix-like cloud environments. The campaign is estimated to have been in operation since early 2019.
Delivery
WatchDog is delivered by exploiting a wide range of known vulnerabilities in commonly-used server software. Environments where security updates have not been applied are therefore most susceptible to compromise.
Activities
WatchDog is mainly programmed in the Go language, which enables its use across different operating systems. When a system is compromised a script is first run to remove cloud security tools, terminate other mining processes and install the WatchDog toolkit.
WatchDog includes multiple processes:
- A network scanner to identify further vulnerable systems and attempt compromise
- A system monitoring module to ensure that the mining software continues to run
- A miner based on XMRig to obtain the Monero cryptocurrency
Remediation advice
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 19 February 2021 12:38 pm