This Cryptomining Malware Launches Linux VMs On Windows and macOS

Cybersecurity researchers from at least two firms today
unveiled details of a new strain of malware that targets Windows
and macOS systems with a Linux-based cryptocurrency mining malware.

It may sound strange, but it’s true.

Dubbed “LoudMiner” and also “Bird Miner,” the
attack leverages command-line based virtualization software on
targeted systems to silently boot an image of Tiny Core Linux OS
that already contains a hacker-activated cryptocurrency mining
software in it.

Isn’t it interesting to use emulation to run single-platform
malware on cross-platforms?

Spotted by researchers at ESET^[1] and Malwarebytes^[2], attackers are
distributing this malware bundled with pirated and cracked copies
of VST (Virtual Studio Technology) software on the Internet and via
Torrent network since August 2018.

VST applications contain sounds, effects, synthesizers, and
other advanced editing features that allow tech-centric audio
professionals to create music.

Researchers have found various malicious versions of nearly 137
VST-related applications, 42 of which are for Windows and 95 for
macOS platform, including Propellerhead Reason, Ableton Live,
Sylenth1, Nexus, Reaktor 6 and AutoTune.

For macOS systems, the software runs multiple shell scripts and
uses the open-source Quick Emulator (QEMU) utility to launch the
virtual Linux OS, and for Windows, it relies on VirtualBox for
emulation.

Once installed and activated, the malware also gains persistence
on the system by installing additional files and then launches
virtual machines in the background.

These Linux OS images have already been pre-configured by attackers
to launch cryptocurrency mining software automatically on the
startup without ever needing a user to login and connect to the
hacker’s command-and-control servers.

The malware “can run two images at once, each taking 128 MB of RAM
and one CPU core” to mine simultaneously.

The attack is another good reason why you should never trust
unofficial and pirated software available on the Internet.