Crypto Mining Malware Has Netted Nearly 5% of all Monero, Says Research

Monero is by far the most popular cryptocurrency among criminals deploying mining malware, according to a new study.

Two researchers, Sergio Pastrana and Guillermo Suarez-Tangil, from Universidad Carlos III de Madrid and King's College London, respectively, published their report last week, estimating that hackers have mined at least 4.32 percent of the total monero in circulation.

The researchers are not sure whether, or what portion, of malware owners have cashed out their crypto, due to lack of information and the fluctuating prices of cryptos.

Around 4.4 million malware samples were analyzed over a 12-year period from 2007 to 2018, and and 1 million malicious miners were identified, the paper says.

Tactics adopted to distribute malware varies, but the pair say that a "Common yet effective approach is to use legitimate infrastructure such as Dropbox or GitHub to host the droppers, and stock mining tools such as claymore and xmrig to do the actual mining."

Which the pair said is "Most prevalent," bitcoin came in at second favorite crypto for illicit mining, though its popularity has decreased over the years.

Of the malware-associated wallets identified by the team, monero was 56 percent more represented than bitcoin, while zcash came in third place.

More generally, instances of crypto-mining malware increased by well over 4,000 percent last year, according to research from McAfee published in December - growth that saw it rapidly overtake the previous favorite, ransomware, over the period.

Back in November, research from Israel-based cybersecurity firm Check Point Software Technologies showed that a monero mining malware, dubbed KingMiner, is evolving through time to avoid detection.

Monero image via Shutterstock; tables via the report.