Two groups of hackers fought for free mining!

According to foreign media reports, Rocke and Pascha, two hacker groups engaged in Monero mining, are working to control as many Linux cloud environments as possible in order to mine cryptocurrencies.

The battle has been going on in secret since the rise of a new hacker group, Pacha, late last year. Both groups have conducted massive scans to find open or unpatched cloud services and servers, then infected them with versatile Linux-based malware.

Pacha has been quite successful in challenging Rocke. By far the more aggressive of the two is the smaller Pacha group, which removes long lists of known crypto-mining malware strains from infected servers. Using this method, Pacha hackers have slowly carved out a niche in the cryptocurrency mining space.

The Pacha group is said to be particularly focused on identifying and removing Rocke miners in order to take “market share” from its competitors. Nacho Sanmillan, a security researcher at Intezer Labs, said that the Rocke group also uses this method of removing competitors from infected servers, but on a smaller scale than Pacha.

Currently, Rocke still has an advantage over Pacha, as the latest Rocke malware has the ability to uninstall cloud security products. The Pacha group is catching up quickly, having recently found a way to exploit a vulnerability in Atlassian Confluence servers.

While initial cryptocurrency mining operations targeted desktop users and standalone web or FTP servers, a shift occurred in early 2018 when a number of cryptocurrency mining groups realized that Linux and Windows servers as part of cloud infrastructure had more processing power than standalone systems, and hackers turned their attention to cloud technologies such as Docker and Kubernetes.

In IoT botnets, there is often competition for routers and IoT devices, and there is also frequent sabotage of competitors.