"C0594 Organization" maliciously attacks thousands of websites with mining attacks, becoming the mining labor of hackers

Sina Finance reported on April 10 that according to monitoring by Tencent Yujian Threat Intelligence Center, a hacker group named "C0594" is active. It launches attacks by embedding mining Trojans in web pages. Once a user visits an infected web page, the mining mode will be turned on.

It is reported that mining requires high computer configuration and is costly. As the market value of virtual currencies such as Bitcoin and Monero continues to rise, illegal hackers have come up with the idea of ​​passing the mining costs on to ordinary netizens. Once they become mining laborers for hackers, they will obviously feel that the browser is slow and the system is abnormal, and the CPU usage rate often soars to more than 90%, which not only seriously affects the normal use of the computer, but also causes the computer performance to deteriorate and the life of the computer to be shortened in the long run.

The web pages of multiple websites, including traditional enterprises, Internet companies, schools and government agencies, were implanted with mining JS scripts. After analysis, the core JS files in this batch of sites were injected with malicious code, which loaded another script file by requesting the same script file, and provided the CoinHive mining code, thereby performing mining on the user's machine. At present, the organization has hacked thousands of corporate, Internet company, school and government agency websites, and the scope of the threat is expanding.