New worm turns PCs into Bitcoin miners

A new worm is threatening to turn computers it infects into miners for the Internet currency Bitcoin, a computer security firm warned Wednesday night (Manila time). Trend Micro said TDL4, a variant of the TDSS malware family that has become notorious for infecting a system’s boot sector to avoid detection, can propagate itself with a worm component. “In the past we’ve reported a couple of attacks involving malware that turns affected systems into Bitcoin miners, and we also said that cybercriminals will increasingly do so in the future. Recently we encountered another malware – a familiar and known malware family — that turns the system into a Bitcoin miner," it said in a blog post. It said the worm, which it detects as WORM_OTORUN.ASH, contains code that will attempt to participate in a Bitcoin pool, Deepbit. Also, Trend Micro noted WORM_OTORUN.ASH has been distributed to various parts of the world in the past few months. “During our monitoring, we have observed as well that WORM_OTORUN.ASH’s command and control (C&C) servers were hosted by dubious Internet Service Providers (ISPs) located in Europe, particularly in Ukraine, Romania, and the Netherlands," it added. But Trend Micro said this is nothing new, as cybercriminals will continue to find ways to monetize their activities, and Bitcoin is just a new way for them to do so. It said Bitcoin has earned the attention of crooks for several reasons, one of which is the fact that Bitcoin is a direct source of income. “This proves to be not very good news for victims, as Bitcoin-mining bots will probably eat up infected systems’ resources," it said. But Trend Micro also noted the high CPU usage of Bitcoin mining may could alert users to something suspicious. Still, it said this may just be the start of cybercriminals’ efforts at using botnets for Bitcoin mining. “As seen in TDL4 and WORM_OTORUN.ASH, it wouldn’t surprise me if Bitcoin mining becomes a trend in today’s botnets. We might just encounter more BOTcoin miners in the near future," it said. — TJD, GMA News