Hackers Installed Cryptominers on Hundreds of Municipal Websites

Unknown hackers have implemented Monero cryptocurrency software for hundreds of websites using the Drupal content management system. At the same time, many affected pages belong to various government agencies, said Troy  Mursch  , a cyber-security specialist at Bad Packets Report.

It is noted that nearly 400 sites were compromised - unknown users installed the browser-based mining software Coinhive, which extracts Montero cryptocurrency using vulnerabilities in older versions of Drupal.

According to Mursch, such "cryptojacking" is not as harmful as extortion viruses, but "still remains a problem - especially for web site operators".

"It's all because Coinhive and other cryptographic software just use JavaScript. All modern browsers and devices support JavaScript, so they can all be used for cryptocurrency mining and, unfortunately, the Coinhive program continues to be misused time after time. In this particular case, Drupal users need to update their software as soon as possible, "Mursch told CoinDesk.

The list of affected sites included the pages of San Diego Zoo, US National Labor Relations Board,  Marion City Administration, Aleppo University, Ringling College of Fine Arts and Design, government of the Mexican city of Chihuahua and others. A complete list of infected sites can be found in a special table.

It is worth noting that not all users of Coinhive have a malicious intent. For example, UNICEF uses software in charitable events.

Earlier, the antivirus company Trend Micro discovered a new virus called HiddenMiner, which uses the capacity of infected Android-smartphones for mining Montero cryptocurrency. Miner can disable the gadget by overloading the processor.