Akamai proposes tool to defang cryptomining botnets

To test the technique, Akamai used XMRogue against a mining campaign and was able to extract the addresses of all mining proxies, identify the central proxy server, and ban it from the pool. It worked. When Akamai first documented this campaign, it generated almost $50,000 annually, but after it disrupted just one proxy, the campaign’s annual revenue decreased by 76% to $12,000. By targeting additional proxies, Akamai believes the revenue could have potentially dropped to zero. “This kind of impact could easily force the attackers to abandon their campaign for good, or take a risk of being identified when making changes that are being monitored,” Akamai concluded.

This doesn’t remove the malicious code from the systems, Lee of the SANS Institute pointed out, but is essentially a disabling tactic to block the core infrastructure around the mining “in a very cool and creative way.”

It will still take astute incident responders and malware analysts to eliminate the botnet software on each endpoint, he pointed out. “However,” he added, “by being able to combine techniques targeting the botnets directly and the infrastructure, let’s consider this a massive win for today.”