Crypto-Jacking Virus Infects 850,000 Servers, Hackers on the Run With Millions

French authorities shut down a botnet army responsible for crypto-jacking thousands of computers across 140 countries.

Yesterday, French cybersecurity, officials dubbed “cyber gendarmes,” announced the disabling of a botnet force 850,000 servers strong operating mostly in Latin America. The botnet head was located in France and was inoculating computers with monero crypto-jacking software, according to a BBC report.

A malicious form of computer predation, crypto-jacking involves remotely and secretly installing crypto mining software onto computers. Infected computers bare electrical and maintenance costs while hackers walk away with the crypto.

The virus was first spotted by private firm Avast in the spring. An email promising money or erotic images linked to the virus and in certain cases infected USB drives also carried the virus.

While the number of machines infected is known, the amount stolen is not. Official estimates run into the millions of euros with the culprits still on the run.

French officials tracked the head pirate server to Île-de-France. The server has been in operation since 2016, utilizing the Retadup virus to crypto jack computers along with stealing personal data from Israeli hospitals, among other nefarious acts.

Over the next six months, French officials shut down the server while moving the virus to unused parts of the web.

“Basically, we managed to detect where was the command server, the control tower of the network of infected computers, the ‘botnet,’” said Jean-Dominique Nollet to France Inter Radio, head of the Center for Combating Digital Crime (C3N). “It was copied, replicated with a server of ours, and made to do things that allow the virus to be idle on the victims’ computers,” he continued.

While a large achievement for the French authorities, Nollet warned rebooting the hack was nearly as easy as a copy and paste command. “Unfortunately we know they can recreate this kind of hacker server at any time,” he said.

Earlier this month, data analysis company Carbon Black released a study on another monero botnet force, infecting some 500,000 servers, operating across eastern Europe and parts of Asia.

Glass image via Shutterstock