Confirming a well-documented trend this year, a new report from the Cyber Threat Alliance finds that illicit cryptocurrency mining has surged this year.

The report, released today, analyzed customer data from alliance members and found that compared with 2017, illicit cryptomining, the process whereby hackers obtain access to a computer or network to install mining software, has shot up 457 percent. EternalBlue, the leaked U.S. National Security Agency hacking code, was blamed for much of the increase.

Although bitcoin was one cryptocurrency mined, Monero was found to be the crypto of illicit mining choice for hackers thanks to its anonymity. Unlike bitcoin, which operates on a public ledger that makes transactions traceable, Monero obfuscates transactions, in theory making them far more difficult to track.

Making headlines is the finding that the EternalBlue exploits are being used in many of the hacks. EternalBlue was released by hacking group Shadow Brokers in April 2017 and it didn’t take long for the exploit to find its way into hacking operations.

Two of last year’s biggest ransomware attacks, WannaCry and NotPetya, used the exploit in their attacks. But in 2018 sneaking code onto computers to mine for cryptocurrencies has turned out to be a more profitable activity.

“For many, this may not seem like an important issue,” the alliance said in a statement. “What difference does it make if someone is stealing my computing power to mine cryptocurrencies? Illicit mining is the ‘canary in the coal mine’ of cybersecurity threats. If illicit cryptocurrency mining is taking place on your network, then you most likely have worse problems and we should consider the future of illicit mining as a strategic threat.”

The report also noted that the rise of illicit cryptomining also highlights issues with patching, given that updates that protect against EternalBlue exploits have long been available.

“The fact that EternalBlue is still being exploited points to a much larger patching problem for organizations,” the alliance noted in a separate fact sheet. “CTA has found numerous instances of old, unpatched devices being targeted with success using publicly disclosed vulnerabilities. In fact, these old vulnerabilities are helping to drive the profitability of illicit mining. EternalBlue is just one example of a broader issue.”

Image: 159526894@N02/Flickr