Full Report
Huntress has recently seen an uptick in compromised TeamViewer accounts being used to install the XMRig cryptocurrency miner. Dive into the analysis here.
Analysis Summary
# Incident Report: XMRig Cryptomining via Compromised TeamViewer Accounts
## Executive Summary
In May 2023, threat actors compromised TeamViewer accounts to gain unauthorized remote access to endpoints for the purpose of installing XMRig cryptocurrency miners. The attackers utilized manual clipboard transfers and PowerShell scripts to deploy the miner as a persistent Windows service. Huntress SOC identified dozens of impacted endpoints across multiple organizations, highlighting a trend of targeting remote access tools that lack multi-factor authentication.
## Incident Details
- **Discovery Date:** Late May 2023
- **Incident Date:** May 2023
- **Affected Organization:** Multiple (Unspecified)
- **Sector:** Various
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** May 2023
- **Vector:** Compromised TeamViewer accounts.
- **Details:** Attackers gained access via TeamViewer, likely through credential stuffing or reused passwords. Telemetry suggests the use of `clip.exe` (clipboard) to transfer commands rather than direct file transfers.
### Lateral Movement
- **Details:** Not explicitly detailed in the report; the focus remained on local endpoint persistence and resource exploitation for cryptomining.
### Data Exfiltration/Impact
- **Impact:** System resource hijacking. The primary impact was the unauthorized use of CPU resources to mine Monero (XMR) via the XMRig miner, leading to performance degradation.
### Detection & Response
- **Discovery:** Huntress SOC detected a suspicious Windows service creation related to the miner.
- **Response actions taken:** Analysts identified the miner configuration file, discovered the attacker's wallet address and mining pool dashboard, and notified all impacted customers with remediation steps to remove the miner and secure TeamViewer instances.
## Attack Methodology
- **Initial Access:** Remote Access Software (TeamViewer).
- **Persistence:** Creation of a Windows Service to ensure the miner restarts upon reboot.
- **Defense Evasion:** Use of `clip.exe` to move scripts to the endpoint (bypassing file transfer logs) and execution via PowerShell.
- **Discovery:** Manual reconnaissance of the endpoint via the TeamViewer session.
- **Impact:** Resource Hijacking (Cryptomining).
## Impact Assessment
- **Financial:** Increased electricity costs and hardware wear-and-tear; loss of productivity.
- **Operational:** Significant business disruption due to system slowdowns and high CPU utilization.
- **Reputational:** Potential concern regarding the security of remote access tools used by the organizations.
## Indicators of Compromise
- **Network indicators:**
- `hXXp://c3poolbat.oss-accelerate.aliyuncs[.]com/autoc3pool.bat`
- **File indicators:**
- `autoc3pool.bat`
- XMRig configuration files.
- **Behavioral indicators:**
- High CPU usage by unauthorized services.
- Unexpected TeamViewer connections from unrecognized IP addresses.
- Execution of `clip.exe` followed immediately by PowerShell `System.Net.WebClient` downloads.
## Response Actions
- **Containment:** Terminates the malicious processes and stops the unauthorized Windows service.
- **Eradication:** Deletion of the XMRig binaries, batch files, and associated registry keys/services.
- **Recovery:** Revoking existing TeamViewer sessions and enforcing credential resets.
## Lessons Learned
- **Credential Security:** Relying on single-factor authentication for remote access tools remains a critical vulnerability.
- **Log Visibility:** TeamViewer logs and Windows PowerShell event logs (Event ID 600) were vital for reconstructing the attack sequence.
- **Clipboard Monitoring:** Attackers are increasingly using the clipboard to "drop" payloads to evade traditional file-transfer detection.
## Recommendations
- **Enforce MFA:** Mandatory Multi-Factor Authentication for all TeamViewer and remote access accounts.
- **Access Control:** Use "Allow Lists" in TeamViewer to restrict access to specific authorized IDs or domains.
- **Monitoring:** Implement alerting for the execution of PowerShell scripts that utilize `WebClient` or `DownloadFile` methods, especially when originating from remote access processes.
- **Credential Hygiene:** Ensure unique, complex passwords for all administrative and remote access accounts to prevent credential stuffing.