Beapy- Symantec's cryptojacking campaign impacting enterprises in Asia

The campaign, dubbed Beapy, uses the EternalBlue exploit and stolen and hardcoded credentials to spread rapidly across networks—including patched machines—to collect credentials from infected computers.

Today, Symantec released new research on a crypto jacking campaign impacting enterprises. The campaign, dubbed Beapy, uses the EternalBlue exploit and stolen and hardcoded credentials to spread rapidly across networks—including patched machines—to collect credentials from infected computers.

Beapy is most heavily affecting enterprises in Asia, with more than 80 per cent of its victims located in China, with other victims in South Korea, Japan, and Vietnam. It is a file-based coin miner that uses email as an initial infection vector – activity was first seen in Symantec telemetry in January 2019 and has increased since March.

File-based coin miners have an advantage over browser-based coin miners because they can mine cryptocurrency faster. The Monero cryptocurrency, the cryptocurrency most commonly mined during crypto jacking attacks, dropped in value by 90 per cent in 2018, so it may make sense that miners that create cryptocurrency faster are now more popular with cybercriminals.

While enterprises might think they don't need to worry about crypto jacking as much as more disruptive threats such as ransomware, it could still have a major impact on the company's operations.

Potential impacts of crypto jacking for businesses include:

• A slowdown in devices' performance, potentially leading to employee frustration and a reduction in productivity

• Overheating batteries

• Devices becoming degraded and unusable, leading to higher IT costs

• Increased costs due to increased electricity usage, and for businesses operating in the cloud that are billed based on CPU usage