The Many Faces of Cryptocurrency

While it may be a bit harsh to label it the currency of crime, Bitcoin and its dozens of cryptocash cousins certainly have an underworld appeal. Profit-motivated cybercriminals are drawn to its decentralized nature and the anonymity that it affords. Cryptocurrency also simplifies cashing out for the bad guys, and the potential for extortion through ransomware and attacks on unsecured exchanges grows exponentially as digital cash inches toward the mainstream.

“These are boom times,” said Flashpoint intelligence analyst Carles Lopez-Penalver. “There was a time when with Bitcoin and cryptocurrency that no one understood it and thought it was a joke. And now it’s gone from that to being a multi-billion-dollar enterprise.”

The range of threats associated with the abuse of cryptocurrency extends from the relatively petty—malware dropping mining software on compromised machines—to the sublime—nation-states accused of stripping exchanges clean for the purposes of funding state-sponsored espionage. It’s a harsh and somewhat unregulated environment that has grown faster than those trying to secure its surroundings have anticipated.

Lopez-Penalver described the early days of cryptocurrency, and especially those focused on maintaining the privacy of its users and transactions, as an academic exercise.

“Was there an initial market study that determined Hansa (a Dark Web marketplace shut down by law enforcement in July 2017) would love it and where you would get the most people using cryptocurrency?” he said. “No, of course not. They had found a cool way of obfuscating transactions and [criminals] decided to carry it out.”

Of Miners and Monero

If you’re looking for low-hanging fruit, it’s largely concentrated among the various families of miners, in particular silent miners, found on the Deep & Dark Web (DDW). Many of them mine Monero, which is marketed as cryptographically secure currency; its advanced obfuscation algorithms hide the origin and destination of transactions, as well as amounts. It is approaching Bitcoin as the currency of choice for criminals purchasing illicit goods and services on the DDW, including malware, stolen personal information, drugs and weapons, Flashpoint research indicates. Bitcoin, despite its mainstream appeal and skyrocketing valuation, operates under a much more transparent blockchain and doesn’t cloak transactions allowing researchers and law enforcement the ability to better analyze criminal activity.

“People who have made the jump have mostly moved to Monero,” Lopez-Penalver said. “Multiple markets have Monero as a currency, and multiple vendors will just transact with Monero; no more Bitcoin.” Lopez-Penalver added that the use of Monero requires a bit of cryptocurrency savvy around knowing how to purchase and move it out of an exchange.

A number of DDW forums sell miners and attackers are distributing them in a number of devious ways, including as a payload in popular exploit kits, malvertising campaigns, and via email-based attacks, to name a few. Last May, attackers used the freshly released NSA exploit EternalBlue and the DoublePulsar rootkit to distribute the Adylkuzz miner, adding an additional layer of sophistication and urgency to these types of incidents.

The end result is an infected computer grinding to a halt as the malware eats up CPU cycles to create virtual money, all to benefit malicious users, including criminal enterprises. The legitimate business with the infected machines on its network could be in line for expensive power and utility costs, as well as hardware-replacement expenses due to wear-and-tear under the weight of cryptocurrency mining.

Dirty Money, Clean Laundry

Cryptocurrency isn’t just a means of generating revenue, it’s also a realm where dirty money is laundered. Flashpoint is aware of a number of criminals discussing DDW-based as well as legitimate services that convert cryptocurrency into payment card funds. In a recent Flashpoint research report, analysts said they have observed actors discussing how to best transfer funds from their crypto wallets to another actor or service providing payment cards, physical cards, or virtual bank accounts.

In the meantime, law enforcement resigns itself to gradual gains against criminals who have already figured out how to use cryptocurrency to beat the system on many levels. The problem figures to intensify, Lopez-Penalver said, as currencies such as Monero inch closer to the mainstream.

“With Bitcoin and blockchain analysis, we are able to explore a little bit who these people are,” he said. “Law enforcement and private enterprises were able to find a good amount of criminals and trace them back to the wallet and get real information about the perpetrator. Advancements in blockchain technology and criminal behavior may make this type of analysis more difficult for law enforcement and researchers in the future.”