New Crypto-Mining Malware Targeting Asian Firms With NSA Tools

A new form of malware discovered by Symantec is targeting enterprises using leaked NSA tools to infect networks and mine monero.

AccessTimeIconApr 26, 2019 at 10:00 a.m. UTC
Updated Sep 13, 2021 at 9:06 a.m. UTC

A new form of malware is targeting enterprises in Asia to mine monero (XMR) cryptocurrency.

Cybersecurity software provider Symantec published the news in a blog post Wednesday, saying that over 80 percent of victims are located in China, with nations such as South Korea, Japan and Vietnam also seeing activity.

Dubbed "Beapy," the malicious code is a file-based crypto miner, not a browser-based one, the firm said. It works by sending a malicious Excel file to victims as an email attachment, downloading the DoublePulsar backdoor onto the victim’s system if the file is opened.

DoublePulsar (notably developed by the U.S. National Security Agency before it was stolen then released to the public in 2017) was also used in the WannaCry ransomware attack in 2017, according to the post.

Once DoublePulsar is installed on to a victim’s machine, the miner is downloaded. At the same time, it uses another leaked NSA tool, EternalBlue, to propagate across the infected network via unpatched computers where it can steal credentials to further access patched machines.

Cryptojacking malware can have a major impact on enterprises, Symantec said, including slowing down device performance, reducing employee productivity and increasing costs.

Although cryptojacking activity has decreased by about 52 percent over the last year, it is still an area of interest among hackers which largely target businesses.

Symantec said:

“Looking at the overall figures for cryptojacking, we can see that there were just under 3 million cryptojacking attempts in March 2019. While a big drop from the peak of February 2018, when there were 8 million cryptojacking attempts, it is still a significant figure.”

The firm said it first noticed Beapy in January of this year, but activity has increased since early March.

Monero's privacy features make it by far the most popular cryptocurrency among hackers deploying mining malware. A recent academic study estimated that cybercriminals have mined around 5 percent of the total monero in circulation.

Earlier this year, researchers at cybersecurity firm Palo Alto Networks discovered a form of malware that takes administrative control to first uninstall cloud security products and then injects code to mine monero. The same team also discovered another variant that steals browser cookies and other information on Apple Mac computers to directly steal cryptocurrencies.

Symantec image via Shutterstock 


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.