{"id":133834,"date":"2020-05-18T15:00:43","date_gmt":"2020-05-18T14:00:43","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=133834"},"modified":"2025-12-03T12:42:57","modified_gmt":"2025-12-03T12:42:57","slug":"report-hackers-targeted-supercomputers-in-europe-to-mine-monero-xmr","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/report-hackers-targeted-supercomputers-in-europe-to-mine-monero-xmr\/","title":{"rendered":"Report: Hackers targeted supercomputers in Europe to mine Monero (XMR)"},"content":{"rendered":"

Supercomputers across Europe fell victim<\/a> to a widespread and seemingly coordinated cybersecurity attack last week, getting hit with the illicit installation of malware focused on mining Monero (XMR).<\/p>\n

German supercomputers most affected<\/h2>\n

Supercomputers in Germany<\/a>, Spain<\/a>, and Switzerland<\/a>, confirmed infections via individual reports last week. All instances had a few details in common \u2014 such as similar network indicators and file names and a malware programmed to specifically mine Monero, the world\u2019s 14th largest cryptocurrency by market cap.<\/p>\n

However, Chris Doman<\/a> of Cado Security noted<\/a> to tech publication ZDNet<\/i> that no definite evidence of the attacks being related to one actor\/group exists, apart from the similarities mentioned above.<\/p>\n

The University of Edinburgh, which runs the ARCHER supercomputer, was first to report an intrusion. They detected exploitation on their login nodes, as published here<\/a>, and swiftly shut down the computer to prevent further attacks. All Secure Shell (SSH) passwords were reset as an additional security measure.<\/p>\n

Germany\u2019s bwHPC announced<\/a> five supercomputing clusters were shutdown after similar \u201csecurity incidences,\u201d all present in technology-centric universities in the country, such as the University of Stuttgart and Tuebingen. Later, the Leibniz Computing Center and Dresden\u2019s Technical University also confirmed disconnecting their computer clusters after a security \u201cbreach.\u201d<\/p>\n

The Swiss National Supercomputing Center was the last to confirm a breach, stating<\/a> \u201cexternal access\u201d to their infrastructure following a \u201ccybersecurity incident.\u201d<\/p>\n

Mining attack presumably not active<\/h2>\n

Notably, none of the University announcements revealed details on the exact nature of the intrusions, and have not confirmed the installation of mining malware.<\/p>\n

But based on the malware samples, Europe\u2019s Computer Security Incident Response Team (CSIRT) published its findings<\/a> and noted \u201cXMR mining hosts\u201d were deployed during certain attack instances.<\/p>\n

The team further referred to proxy-hosts, noting:<\/p>\n

The attacker uses these hosts from the XMR mining hosts, to connect to other XMR-proxy hosts and eventually to the actual mining server.<\/p><\/blockquote>\n

In one instance, an XMR mining bot was configured to operate only at night hours, presumably to prevent detection.<\/p>\n

Cado Security\u2019s individual analysis<\/a> found out attackers seemed to exploit a \u201cCVE-2019-15666″ vulnerability to attain root access, post-which an application to mine Monero was likely installed.<\/p>\n

The firm, based on its research, stated attackers might have used compromised SSH credentials to gain access to supercomputers, with the hacked logins belonging to universities in Poland and China.<\/p>\n

\n

I took a look at the recent attacks against Supercomputers and found some more details on attacks against Supercomputers in the UK, US, Germany and elsewhere -> https:\/\/t.co\/EXdxB2jPI1<\/a> pic.twitter.com\/3gOaLKCfyQ<\/a><\/p>\n

— chris doman (@chrisdoman) May 16, 2020<\/a><\/p><\/blockquote>\n