Ransomware Hackers and Scammers Exploit Cloud Mining for Cryptocurrency Laundering
According to recent findings, it has been revealed that ransomware actors and cryptocurrency scammers are now utilizing cloud mining services to launder digital assets, joining nation-state actors in this abusive practice.
Blockchain analytics firm Chainalysis stated in a report shared with The Hacker News that while cryptocurrency mining is an essential part of the industry, it also appeals to malicious actors as it offers a way to acquire money with a clean on-chain source. The report highlighted the case of North Korea-based APT43, which employed hash rental and cloud mining services to obfuscate the forensic trail and cleanse stolen cryptocurrency.
Cloud mining services allow users to rent computer systems and utilize their hash power for mining cryptocurrencies without the need to manage the hardware themselves. Chainalysis emphasized that it's not only nation-state hacking groups leveraging these services. They cited an example where mining pools and wallets associated with ransomware actors were used to send funds to a highly active deposit address on an undisclosed mainstream crypto exchange. This involved significant sums, with $19.1 million originating from four ransomware wallet addresses and $14.1 million from three mining pools.
The funds were routed through intermediary wallets and pools, creating the illusion that the proceeds came from mining rather than ransomware. The cumulative value of assets sent from ransomware wallets to exchanges through mining pools has surged from under $10,000 in Q1 2018 to almost $50 million in Q1 2023, indicating the growing popularity of this trend.
Chainalysis noted that mining pools may play a significant role in the money laundering strategies of many ransomware actors. Moreover, scam operators like the BitClub Network have also incorporated mining pools into their illicit activities, mingling their ill-gotten Bitcoin proceeds with assets obtained from a Russian-based Bitcoin mining operation and BTC-e, a crypto exchange known for facilitating money laundering from the Mt. Gox hack.
What is Could Crypto Mining and Why is it an Enticing Option for Ransomware Threat Actors?
Cloud crypto mining refers to the practice of using cloud-based services to mine cryptocurrencies. Instead of setting up and managing their own mining hardware, individuals or organizations can rent computing power from cloud mining providers and utilize it for mining operations.
Ransomware threat actors find cloud crypto mining enticing for several reasons. Firstly, it allows them to mine cryptocurrencies without the need to invest in expensive hardware or deal with the operational complexities of maintaining a mining infrastructure. By renting computing power from cloud mining services, they can quickly start mining and generating cryptocurrency.
Secondly, cloud mining provides a layer of anonymity and obfuscation for threat actors. It allows them to distance themselves from direct involvement in mining activities, making it more challenging for law enforcement or security researchers to trace their operations back to specific individuals or groups. By leveraging cloud services, ransomware actors can hide their true identities and location, making it harder to attribute their activities.
Additionally, cloud mining offers scalability and flexibility. Ransomware threat actors can easily adjust their mining operations based on market conditions or changes in their objectives. They can increase or decrease the rented computing power as needed, allowing them to adapt to fluctuations in cryptocurrency prices or focus on mining specific cryptocurrencies that offer higher profitability.
Moreover, cloud mining provides a way for threat actors to legitimize their illicitly obtained funds. By mining cryptocurrencies through cloud services, they can create a facade of legitimate income and mask the origins of their funds. This money laundering technique makes it harder to trace the flow of funds and associate them with illegal activities such as ransomware attacks.
Overall, cloud crypto mining offers convenience, anonymity, scalability, and the ability to launder illicit funds, making it an enticing option for ransomware threat actors looking to generate revenue and obscure their tracks in the digital realm.
