휴대전화가 해킹되었는지 확인하는 방법 – 7개의 경고신호 - Surfshark
보통의 바이러스백신 앱은 일반적인 위협을 없앨 수 있습니다. 하지만 다른 앱들처럼 주기적으로 업데이트가 필요합니다. 이러한 업데이트에는 최근 발견된 보안 문제에 ...
암호화폐를 채굴하거나
데이터 사용이 예상치 못하게 증가하면 휴대전화가 해킹되어 데이터가 전송된다는 의미입니다. 예를 들어, 휴대전화의 자원을 사용하여 <anchor>암호화폐를 채굴하거나</anchor> 사진을 훔칠 수 있습니다. 또한 해커가 당신을 염탐한다는 의미입니다. 앱 데이터 사용을 확인하여 어떤 앱이 문제인지 확인해야 합니다. 이상이 생기면 휴대전화가 해킹되었는지 알 수 있습니다.
What is cryptojacking? How to prevent, detect, and recover from it | CSO Online
What is cryptojacking? How to prevent, detect, and recover from it \| CSO Online

[Home page](https://www.csoonline.com)

- Topics
- [Events](https://www.csoonline.com/events/)
- [Newsletters](https://www.csoonline.com/newsletters/signup/)
- [Resources](https://us.resources.csoonline.com/)
- [Community](https://www.csoonline.com/community/)

## About

- [About Us](https://www.csoonline.com/about-us/)
- [Advertise](https://foundryco.com/our-brands/cso/)
- [Contact Us](https://www.csoonline.com/contact-us/)
- [Foundry Careers](https://foundryco.com/work-here/)
- [Reprints](https://www.csoonline.com/contact-us/#republication-permissions)
- [Newsletters](https://www.csoonline.com/newsletters/signup/)

## Policies

- [Terms of Service](https://foundryco.com/terms-of-service-agreement/)
- [Privacy Policy](https://www.csoonline.com/privacy-policy/)
- [Cookie Policy](https://www.csoonline.com/cookie-policy/)
- [Member Preferences](https://www.csoonline.com/member-preferences/)
- [About AdChoices](https://www.csoonline.com/about-adchoices/)
- [E-commerce Links](https://www.csoonline.com/affiliates/)
- [Your California Privacy Rights](https://www.csoonline.com/your-california-privacy-rights/)

## Our Network

- [CIO](https://www.cio.com/)
- [Computerworld](https://www.computerworld.com/)
- [InfoWorld](https://www.infoworld.com/)
- [Network World](https://www.networkworld.com)

## More

- [Awards](https://www.csoonline.com/awards/)
- [Blogs](https://www.csoonline.com/blogs/)
- [BrandPosts](https://www.csoonline.com/brandposts/)
- [Events](https://www.csoonline.com/events/)
- [Podcasts](https://www.csoonline.com/podcasts/)
- [Videos](https://www.csoonline.com/videos/)
- [Enterprise Buyer’s Guides](https://www.csoonline.com/enterprise-buyers-guide/)

Close

- [Artificial Intelligence](https://www.csoonline.com/artificial-intelligence/)
- [Generative AI](https://www.csoonline.com/generative-ai/)
- [Business Operations](https://www.csoonline.com/business-operations/)
- [Careers](https://www.csoonline.com/careers/)
- [Industry](https://www.csoonline.com/industry/)
- [IT Leadership](https://www.csoonline.com/it-leadership/)
- [Compliance](https://www.csoonline.com/compliance/)
- [Security](https://www.csoonline.com/security/)
- [Application Security](https://www.csoonline.com/application-security/)
- [Business Continuity](https://www.csoonline.com/business-continuity/)
- [Cloud Security](https://www.csoonline.com/cloud-security/)

- [Critical Infrastructure](https://www.csoonline.com/critical-infrastructure/)
- [Cybercrime](https://www.csoonline.com/cybercrime/)
- [Identity and Access Management](https://www.csoonline.com/identity-and-access-management/)
- [Network Security](https://www.csoonline.com/network-security/)
- [Physical Security](https://www.csoonline.com/physical-security/)
- [Privacy](https://www.csoonline.com/privacy/)
- [Risk Management](https://www.csoonline.com/risk-management/)
- [Security Infrastructure](https://www.csoonline.com/security-infrastructure/)
- [Vulnerabilities](https://www.csoonline.com/vulnerabilities/)
- [Software Development](https://www.csoonline.com/software-development/)
- [Enterprise Buyer’s Guides](https://www.csoonline.com/enterprise-buyers-guide/)

Back

Close

## Americas

- United States

## Asia

- [ASEAN](https://www.csoonline.com/asean/)
- [India](https://www.csoonline.com/in/)

## Europe

- [United Kingdom](https://www.csoonline.com/uk/)

## Oceania

- [Australia](https://www.csoonline.com/au/)

Back

Close

Popular Topics

- Search
- US-EN

- Topics
- [Events](https://www.csoonline.com/events/)
- [Newsletters](https://www.csoonline.com/newsletters/signup/)
- [Resources](https://us.resources.csoonline.com/)
- [Community](https://www.csoonline.com/community/)
- About
- Policies
- Our Network
- More

Back

## Topics

- [Artificial Intelligence](https://www.csoonline.com/artificial-intelligence/)
- [Generative AI](https://www.csoonline.com/generative-ai/)
- [Business Operations](https://www.csoonline.com/business-operations/)
- [Careers](https://www.csoonline.com/careers/)
- [Industry](https://www.csoonline.com/industry/)
- [IT Leadership](https://www.csoonline.com/it-leadership/)
- [Compliance](https://www.csoonline.com/compliance/)
- [Security](https://www.csoonline.com/security/)
- [Application Security](https://www.csoonline.com/application-security/)
- [Business Continuity](https://www.csoonline.com/business-continuity/)
- [Cloud Security](https://www.csoonline.com/cloud-security/)
- [Critical Infrastructure](https://www.csoonline.com/critical-infrastructure/)
- [Cybercrime](https://www.csoonline.com/cybercrime/)
- [Identity and Access Management](https://www.csoonline.com/identity-and-access-management/)
- [Network Security](https://www.csoonline.com/network-security/)
- [Physical Security](https://www.csoonline.com/physical-security/)
- [Privacy](https://www.csoonline.com/privacy/)
- [Risk Management](https://www.csoonline.com/risk-management/)
- [Security Infrastructure](https://www.csoonline.com/security-infrastructure/)
- [Vulnerabilities](https://www.csoonline.com/vulnerabilities/)
- [Software Development](https://www.csoonline.com/application-development/)
- [Enterprise Buyer’s Guides](https://www.csoonline.com/enterprise-buyers-guide/)

Back

## About

- [About Us](https://www.csoonline.com/about-us/)
- [Advertise](https://foundryco.com/our-brands/cso/)
- [Contact Us](https://www.csoonline.com/contact-us/)
- [Foundry Careers](https://foundryco.com/work-here/)
- [Reprints](https://www.csoonline.com/contact-us/#republication-permissions)
- [Newsletters](https://www.csoonline.com/newsletters/signup/)

Back

## Policies

- [Terms of Service](https://foundryco.com/terms-of-service-agreement/)
- [Privacy Policy](https://www.csoonline.com/privacy-policy/)
- [Cookie Policy](https://www.csoonline.com/cookie-policy/)
- [Member Preferences](https://www.csoonline.com/member-preferences/)
- [About AdChoices](https://www.csoonline.com/about-adchoices/)
- [E-commerce Links](https://www.csoonline.com/affiliates/)
- [Your California Privacy Rights](https://www.csoonline.com/your-california-privacy-rights/)

Back

## Our Network

- [CIO](https://www.cio.com/)
- [Computerworld](https://www.computerworld.com/)
- [InfoWorld](https://www.infoworld.com/)
- [Network World](https://www.networkworld.com)

Back

## More

- [Awards](https://www.csoonline.com/awards/)
- [Blogs](https://www.csoonline.com/blogs/)
- [BrandPosts](https://www.csoonline.com/brandposts/)
- [Events](https://www.csoonline.com/events/)
- [Podcasts](https://www.csoonline.com/podcasts/)
- [Videos](https://www.csoonline.com/videos/)
- [Enterprise Buyer’s Guides](https://www.csoonline.com/enterprise-buyers-guide/)

[Home](https://www.csoonline.com/) [Security](https://www.csoonline.com/security/)Cryptojacking explained: How to prevent, detect, and recover from it

![ericka_chickowski](https://www.csoonline.com/wp-content/uploads/2024/08/518-0-56430900-1724651040-ericka-100925739-orig.jpg?quality=50&strip=all&w=150)

by [Ericka Chickowski](https://www.csoonline.com/profile/ericka-chickowski/)

CSO contributor

# Cryptojacking explained: How to prevent, detect, and recover from it

Feature

Jun 20, 202214 mins

CybercrimeInternetMalware

## Criminals are using ransomware-like tactics and poisoned websites to get your employees’ computers to mine cryptocurrencies. Here’s what you can do to stop it.

![bitcoin coin sitting in glass pieces or gravel](https://www.csoonline.com/wp-content/uploads/2023/06/kanchanara-9pCV2MB65y8-unsplash.jpg?quality=50&strip=all&w=1024)

Credit: Kanchanara / Unsplash

## **Cryptojacking definition**

Cryptojacking is the unauthorized use of someone else’s compute resources to mine cryptocurrency. Hackers seek to hijack any kind of systems they can take over—desktops, servers, cloud infrastructure and more—to illicitly mine for crypto coins.

Regardless of the delivery mechanism, cryptojacking code typically works quietly in the background as unsuspecting victims use their systems normally. The only signs they might notice is slower performance, lags in execution, overheating, excessive power consumption, or abnormally high cloud computing bills.

## **How cryptojacking works**

Coin mining is a legitimate process in the cryptocurrency world that releases new cryptocurrency into circulation. The process works by rewarding currency to the first miner who solves a complex computational problem. That problem completes blocks of verified transactions that are added to the cryptocurrency blockchain.

“Miners are essentially getting paid for their work as auditors. They are doing the work of verifying the legitimacy of Bitcoin transactions,” detailed [a recent Investopedia explainer](https://www.investopedia.com/tech/how-does-bitcoin-mining-work/) on how Bitcoin mining works. “In addition to lining the pockets of miners and supporting the Bitcoin ecosystem, mining serves another vital purpose: It is the only way to release new cryptocurrency into circulation.”

Earning cryptocurrency via coin mining typically takes a huge amount of processing power and energy to carry off. Additionally, the cryptocurrency ecosystem is designed in a way that makes mining harder and reduces the rewards for it over time and with more mining competition. This makes legitimate cryptocurrency coin mining an extremely costly affair, with expenses rising all the time.

Cybercriminals slash mining overhead by simply stealing compute and energy resources. They use a range of hacking techniques to gain access to systems that will do the computational work illicitly and then have these hijacked systems send the results to a server controlled by the hacker.

## Cryptojacking attack methods

The attack methods are limited only by the cryptojackers’ creativity, but the following are some of the most common ones used today.

### **Endpoint attacks**

In the past, cryptojacking was primarily an endpoint malware play, existing as yet another moneymaking objective for dropping malware on desktops and laptops. Traditional cryptojacking malware is delivered via typical routes like fileless malware, phishing schemes, and embedded malicious scripts on websites and in web apps.

The most basic way cryptojacking attackers can steal resources is by sending endpoint users a legitimate-looking email that encourages them to click on a link that runs code to place a cryptomining script on their computer. It runs in the background and sends results back via a command and control (C2) infrastructure.

Another method is to inject a script on a website or an ad that is delivered to multiple websites. Once victims visit the website or the infected ad pops up in their browsers, the script automatically executes. No code is stored on the victims’ computers.

These avenues still remain a legitimate concern, though criminals have added significantly more sophisticated techniques to their cryptojacking playbooks as they seek to scale up profits, with some of these evolving methods described below.

### **Scan for vulnerable servers and network devices**

Attackers seek to amp up the profitability of cryptojacking by expanding their horizons to servers, network devices, and even IoT devices. Servers, for example, are a particularly juicy target since they usually are usually higher powered than a run-of-the-mill desktop. They’re also a prime hunting ground in 2022 as the bad guys scan for servers exposed to the public internet that contain vulnerabilities such as Log4J, exploiting the flaw and quietly loading cryptomining software on the system that’s connected to the hacker’s servers. Often attackers will use the initially compromised system to move their cryptojacking laterally into other network devices.

“We’re seeing an uptick in cryptomining stemming from the Log4J vulnerability,” says Sally Vincent, senior threat research engineer for LogRhythm. “Hackers are breaking into networks and installing malware that uses storage to mine cryptos.”

### **Software supply chain attacks**

Cybercriminals are targeting the software supply chain by [seeding open-source code repositories](https://www.csoonline.com/article/572015/npm-javascript-registry-suffers-massive-influx-of-malware-report-says.html) with malicious packages and libraries that contain cryptojacking scripts embedded within their code. With developers downloading these packages by the millions around the globe, these attacks can rapidly scale up cryptojacking infrastructure for the bad guys in two ways. The malicious packages can be used to target developer systems—and the networks and cloud resources they connect to—to use them directly as illicit cryptomining resources. Or they can leverage these attacks to poison the software that these developers are building with components that execute cryptomining scripts on the machines of an application’s end user.

### **Leveraging cloud infrastructure**

Many cryptojacking enterprises are taking advantage of the scalability of cloud resources by breaking into cloud infrastructure and tapping into an even broader collection of compute pools to power their mining activity. A [study last fall by Google’s Cybersecurity Action Team](https://services.google.com/fh/files/misc/gcat_threathorizons_brief_nov2021.pdf) reported that 86% of compromised cloud instances are used for cryptomining.

“Today, attackers are targeting cloud services by any means to mine more and more cryptocurrency, as cloud services can allow them to run their calculations on a larger scale than just a single local machine, whether they’re taking over a user’s managed cloud environment or even abusing SaaS applications to execute their calculations,” Guy Arazi, senior security researcher for Palo Alto Networks, wrote [in a blog post](https://www.paloaltonetworks.com/blog/security-operations/stopping-cryptojacking-attacks-with-and-without-an-agent/).

One of the common methods to do this is by scanning for exposed container APIs or unsecured cloud storage buckets and using that access to start loading coin-mining software on impacted container instances or cloud servers. The attack is typically automated with scanning software that looks for servers accessible to the public internet with exposed APIs or unauthenticated access possible. Attackers generally use scripts to drop the miner payloads onto the initial system and to look for ways to propagate across connected cloud systems.

“The profitability and ease of conducting cryptojacking at scale makes this type of attack low-hanging fruit,” said Matt Muir, security researcher for Cado Security, [in a blog post](https://www.cadosecurity.com/tales-from-the-honeypot-watchdog-evolves-with-a-new-multi-stage-cryptojacking-attack/) explaining that cloud-based attacks are particularly lucrative. “This will likely continue for as long as users continue to expose services such as Docker and Redis to untrusted networks.”

## Why cryptojacking is popular

According to a [report](https://reasonlabs.com/reports/reasonlabs-report.pdf) by ReasonLabs, in the last year 58.4% of all Trojans detected were cryptojacking coin miners. Meantime, another study by SonicWall found that 2021 was the worst year to date for cryptojacking attacks, with the category logging 97.1 million attacks over the course of the year. These numbers are so strong because cryptojacking is virtually minting money for cybercriminals.

When a crook can mine for cryptocurrency on a seemingly limitless pool of free compute resources from victim machines, the upside for them is huge. Even with the precipitous drop in Bitcoin valuation this spring that brought it below the $30,000 level, cryptojackers’ illicit margins still make business sense as the value of what they mine far outstrips the costs of their criminal infrastructure.

## Real-world cryptojacking examples

### **WatchDog targets Docker Engine API endpoints and Redis servers**

A honeypot from the security research team at Cado Labs [discovered](https://www.cadosecurity.com/tales-from-the-honeypot-watchdog-evolves-with-a-new-multi-stage-cryptojacking-attack/) a multi-stage cryptojacking attack that targets exposed Docker Engine API endpoints and Redis servers, and can propogate in a worm-like fashion. The attack is perpetrated by the WatchDog attack group, which has been particularly active in late 2021 and 2022 with numerous cryptojacking campaigns.

### **Alibaba ECS instances in cryptomining crosshairs**

TeamTNT was one of the first hacking groups to shift cryptojacking focus heavily to cloud-oriented services. Researchers with TrendMicro in late 2021 [reported](https://www.trendmicro.com/en_us/research/21/k/groups-target-alibaba-ecs-instances-for-cryptojacking.html) that this group, along with rivals like the Kinsig gang, were conducting cryptojacking campaigns that installed miners in Alibaba Elastic Computing Service (ECS) instances and disabling security features to evade detection.

### **Miner bots and backdoors use Log4J to attack VMware Horizon servers**

The Log4Shell vulnerability has been a boon to cryptojacking attackers in 2022. In one marked example, Sophos researchers [found](https://news.sophos.com/en-us/2022/03/29/horde-of-miner-bots-and-backdoors-leveraged-log4j-to-attack-vmware-horizon-servers/) earlier this year that a ‘horde’ of attackers were targeting VMware Horizon servers to deliver a range of crypojacking payloads that included the z0Miner, the JavaX miner and at least two XMRig variants, Jin and Mimu cryptocurrency miner bots.

### **Supply chain attacks via npm libraries**

The software supply chain security experts at Sonatype in fall of 2021 sounded the alarm on malicious cryptomining packages hiding in npm, the JavaScript package repository used by developers worldwide. At the time it found a trio of packages, at least one of which was impersonating a popular, legitimate library used by developers called “ua-parser-js,” which gets over 7 million weekly downloads and would be an ideal way to lure in developers to accidentally download a malicious bit of code and install it in their software.

A few months after that report, researchers WhiteSource (now Mend) released an [additional report](https://www.mend.io/npm-threat-report-for-javascript-package-registry/) that showed npm is swarming with malicious code—as many as 1,300 malicious packages that include cryptojacking and other nefarious behavior.

### **Romanian attackers target Linux machines with cryptomining malware**

Last summer Bitdefender [discovered](https://www.bitdefender.com/blog/labs/how-we-tracked-a-threat-group-running-an-active-cryptojacking-campaign) a Romanian threat group that was targeting Linux-based machines with SSH credentials to deploy Monero mining malware. The tools they used were distributed on an as-a-service model. This example was on the spear tip of what appears to be a growing trend of Linux system cryptomining attacks. A [report](https://ir.vmware.com/websites/vmware/English/2120/us-press-release.html?airportNewsID=47b6e25a-5a8b-4189-b20d-99a6da9b1663) earlier this year from VMware detailed a growing targeting of Linux-based multi-cloud environments, particularly using the XMRig mining software.

“Many of the cryptomining samples from Linux-based systems have some relationship to the XMRig application,” explained the report, which showed that 89% of cryptomining attacks used XMRig-related libraries. “Therefore, when XMRig-specific libraries and modules in Linux binaries are identified, it is likely evidence of potential cryptomining behavior.

### **CoinStomp uses sophisticated evasion tactics**

CoinStop is another cryptojacking campaign recently discovered to be targeting Asian cloud service providers (CSPs). This one distinguished itself by its anti-forensics and evasion measures. These included timestomping to manipulate system timestamps, removal of system cryptographic policies, and the use of the he /dev/tcp device file to create a reverse shell session, explained Cado’s Muir in a [report](https://www.cadosecurity.com/coinstomp-malware-family-targets-asian-cloud-service-providers/) on the attack.

### **Cryptocurrency farm found in warehouse**

Cryptojackers can sometimes go to great lengths to steal not only processing power but also energy and network resources from corporate infrastructure. Last year Darktrace analysts [highlighted](https://www.darktrace.com/en/blog/crypto-mining-malware-uncovering-a-cryptocurrency-farm-in-a-warehouse/) an anonymous example from one of its clients where it discovered a cryptomining farm in a warehouse that was disguised inside an unassuming set of cardboard boxes. Inside was a stealthy rig running multiple GPUs that were hooked into the company’s network power,

## How to prevent cryptojacking

As it has evolved into a multi-vector attack that spans across endpoint, server, and cloud resources, preventing cryptojacking takes an orchestrated and well-rounded defense strategy. The following steps can help prevent cryptojacking from running rampant on enterprise resources.

**Employ strong endpoint protection:** The foundation of that is using endpoint protection and anti-malware that’s capable of detecting cryptominers, as well as keeping web filters up to date and managing browser extension to minimize risk of browser-based scripts from executing. Organizations should ideally look for endpoint protection platforms that can extend out to servers and beyond.

**Patch and harden servers (and everything else).** Cryptojackers tend to look for the lowest hanging fruit that they can quietly harvest—that includes scanning for publicly exposed servers containing older vulnerabilities. Basic server hardening that includes patching, turning off unused services, and limiting external footprints can go a long way toward minimizing the risk of server-based attacks.

**Use software composition analysis.** [Software composition analysis (SCA)](https://www.csoonline.com/article/571621/software-composition-analysis-explained-and-how-it-identifies-open-source-software-risks.html) tools provide better visibility into what components are being used within software to prevent supply chain attacks that leverage coin mining scripts.

**Hunt down cloud misconfigurations.** One of the most impactful ways organizations can stop cryptojacking in the cloud is by tightening cloud and container configurations. That means finding cloud services exposed to the public internet without proper authentication, rooting out exposed API servers, and eliminating credentials and other secrets stored in developer environments and hardcoded into applications.

## **How to detect cryptojacking**

Cryptojacking is a classic low-and-slow cyberattack designed to leave minimal signs behind to avoid long-term detection. While endpoint protection platforms and endpoint detection and response technologies have come a long way in alerting to cryptojacking attacks, the bad guys are masters of evasion on this front and detecting illicit coin miners can still prove difficult, especially when only a few systems are compromised. The following are some additional methods for flagging signs of cryptojacking.

**Train your help desk to look for signs of cryptomining.** Sometimes the first indication on user endpoints is a spike in help desk complaints about slow computer performance. That should raise a red flag to investigate further, as could devices over-heating or poor battery performance in mobile devices.

**Deploy a network monitoring solution.** Network monitoring tools can offer a powerful tool in picking up on the kinds of web traffic and outbound C2 traffic that indicates cryptojacking activity, no matter the device it is coming from.

“If you have good egress filtering on a server where you’re watching for outbound connection initiation, that can be good detection for \[cryptomining malware\],” \],” says Travis Farral, vice president and CISO at Archaea Energy. He warns, though, that cryptominer authors can write their malware to avoid that detection method.

**Use cloud monitoring and container runtime security.** Evolving tools like cloud monitoring and container runtime security scanning can offer additional visibility into cloud environments that may be impacted by unauthorized cryptominers. Cloud providers are baking in this kind of visibility into their service, sometimes as add-ons. For instance, Google Cloud expanded its Security Command Center earlier this year to include what it calls its Virtual Machine Threat Detection (VMTD) to pick up on signs of cryptomining in the cloud, among other cloud threats.

**Engage in regular threat hunts.** Since so many cryptojacking attacks are stealthy and leave few tracks, organizations may need to take more active measures like threat hunting to regularly seek out subtle signs of compromise and follow through with investigations.

“Endpoint security and SOC teams should invest time into active exercises and threat hunts instead of waiting around for something potentially catastrophic to happen,” LogRhythm’s Vincent says.

**Monitor your websites for cryptomining code**. Farral warns that cryptojackers are finding ways to place bits of Javascript code on web servers. “The server itself isn’t the target, but anyone visiting the website itself \[risks infection\],” he says. He recommends regularly monitoring for file changes on the web server or changes to the pages themselves.

## **How to respond to a cryptojacking attack**

After illicit cryptomining activity has been detected, responding to a cryptojacking attack should follow standard cyber incident response steps that include containment, eradication, recovery, and lessons learned. Some tips for how to respond to a cryptojacking attack include:

**Kill web-delivered scripts.** For in-browser JavaScript attacks, the solution is simple once cryptomining is detected: Kill the browser tab running the script. IT should note the website URL that’s the source of the script and update the company’s web filters to block it.

**Shut down compromised container instances.** Immutable cloud infrastructure like container instances that are compromised with coin miners can also be handled simply, by shutting down infected container instances and starting fresh. However, organizations must dig into the root causes that led to the container compromise in the first place. This means looking for signs that the container dashboard and credentials have been compromised and examining connected cloud resources for signs of compromise. A key step is ensuring that the fresh new container image to replace the old one isn’t similarly configured.

**Reduce permissions and regenerate API keys.** Eradicating and fully recovering from cloud-based cryptojacking will require organizations to reduce permissions to impacted cloud resources (and those connected to them) and regenerating API keys to prevent attackers from walking right back into the same cloud environment.

**Learn and adapt.** Use the experience to better understand how the attacker was able to compromise your systems. Update your user, helpdesk, IT, and SOC analyst training so they are better able to identify cryptojacking attempts and respond accordingly.

_Editor’s note: This article, orginally published in February 2018, has been updated to include new research, best practices, and cryptojacking examples._

## Related content

- [analysis\
**The 18 biggest data breaches of the 21st century** \
Data breaches affecting millions of users are far too common. Here are some of the biggest, baddest breaches in recent memory.\
\
By Michael Hill, Dan Swinhoe and John Leyden \
\
Sep 12, 202418 mins\
\
Data BreachPhishingRSA Conference](https://www.csoonline.com/article/534628/the-biggest-data-breaches-of-the-21st-century.html)
- [news\
**The US offers a $2.5M bounty for the arrest of Angler Exploit Kit co-distributor** \
The State Department has placed a bounty of up to $2.5 million on information leading to Volodymyr Kedariya’s arrest.\
\
By Shweta Sharma \
\
Aug 29, 20243 mins\
\
HackingCybercrime](https://www.csoonline.com/article/3498240/the-us-offers-a-2-5m-bounty-for-the-arrest-of-angler-exploit-kit-co-distributor.html)
- [analysis\
**RansomHub, Play, Akira: Die gefährlichsten Ransomware-Banden** \
Nachdem LockBit durch Polizeieinsätze geschwächt wurde, versuchen andere Banden wie Play und Cactus deren Platz einzunehmen.\
\
By Martin Bayer \
\
Aug 14, 20245 mins\
\
Cybercrime](https://www.csoonline.com/article/3495388/ransomhub-play-akira-die-gefahrlichsten-ransomware-banden.html)
- [analysis\
**Sellafield drohte IT-GAU: Massive Security-Lücken in britischer Atomanlage** \
Nachdem Untersuchungen immer mehr katastrophale Security-Lücken im britischen Sellafield offenlegten, haben die Behörden ein Verfahren gegen die Betreiber eröffnet.\
\
By Martin Bayer \
\
Aug 13, 20245 mins\
\
Cybercrime](https://www.csoonline.com/article/3495394/sellafield-drohte-it-gau-massive-security-lucken-in-britischer-atomanlage.html)

- [PODCASTS](https://www.csoonline.com/podcasts/)
- [VIDEOS](https://www.csoonline.com/videos/)
- [RESOURCES](https://us.resources.csoonline.com)
- [EVENTS](https://www.csoonline.com/events/)

SUBSCRIBE TO OUR NEWSLETTER

### From our editors straight to your inbox

Get started by entering your email address below.

Please enter a valid email address

Subscribe

![ericka_chickowski](https://www.csoonline.com/wp-content/uploads/2024/08/518-0-56430900-1724651040-ericka-100925739-orig.jpg?quality=50&strip=all&w=250)

by [Ericka Chickowski](https://www.csoonline.com/profile/ericka-chickowski/)

CSO contributor

An award-winning freelance writer, Ericka Chickowski specializes in telling stories about the intersection of information technology and business innovation. She has focused on cybersecurity for over 15 years and keeps her finger on the pulse of the most relevant trends in cybersecurity.

## More from this author

- [analysis\
**10 essenzielle Maßnahmen für physische Sicherheit**\
\
By Ericka Chickowski \
\
Aug 06, 2024 11 mins\
\
Risk Management](https://www.csoonline.com/article/3493920/10-essenzielle-masnahmen-fur-physische-sicherheit.html)
- [feature\
**How CISOs can protect their personal liability**\
\
By Ericka Chickowski \
\
Jul 03, 2024 13 mins\
\
CSO and CISOEmployee Protection](https://www.csoonline.com/article/2505459/how-cisos-can-protect-their-personal-liability.html)
- [analysis\
**Customer Identity & Access Management: Die 6 besten CIAM-Tools**\
\
By Ericka Chickowski \
\
May 31, 2024 8 mins\
\
Identity and Access ManagementSecurity Infrastructure](https://www.csoonline.com/article/3492789/customer-identity-access-management-die-6-besten-ciam-tools.html)
- [analysis\
**Identity & Access Management Die 9 besten IAM-Tools**\
\
By Ericka Chickowski \
\
May 27, 2024 9 mins\
\
Identity and Access ManagementSoftware Development](https://www.csoonline.com/article/3495114/identity-access-managementdie-9-besten-iam-tools.html)

- [analysis\
**Schutz vor Business E-Mail Compromise: 8 wichtige Punkte für Ihre BEC-Richtlinie**\
\
By Ericka Chickowski \
\
May 24, 2024 12 mins\
\
Risk Management](https://www.csoonline.com/article/3491751/schutz-vor-business-e-mail-compromise-8-wichtige-punkte-fur-ihre-bec-richtlinie.html)
- [feature\
**Top 10 physical security considerations for CISOs**\
\
By Ericka Chickowski \
\
Apr 23, 2024 14 mins\
\
Critical InfrastructureSecurity InfrastructureSecurity](https://www.csoonline.com/article/566635/what-is-physical-security-how-to-keep-your-facilities-and-devices-safe-from-on-site-attackers.html)
- [feature\
**8 things that should be in a company BEC policy document**\
\
By Ericka Chickowski \
\
Feb 05, 2024 12 mins\
\
Email SecuritySecurity Practices](https://www.csoonline.com/article/1303054/8-things-that-should-be-in-a-company-bec-policy-document.html)
- [feature\
**What should be in a company-wide policy on low-code/no-code development**\
\
By Ericka Chickowski \
\
Dec 06, 2023 15 mins\
\
Application SecuritySecurity Practices](https://www.csoonline.com/article/1251172/what-should-be-in-a-company-wide-policy-on-low-code-no-code-development.html)

#### Show me more

PopularArticlesPodcastsVideos

[feature\
\
**Aflac’s shift to passkeys brings big business benefits** \
\
By Bob Violino\
\
Sep 13, 20247 mins\
\
PasswordsInsurance IndustryAuthentication\
\
![Image](https://www.csoonline.com/wp-content/uploads/2024/09/3518747-0-61563600-1726221838-tim-callahan-stylized_1600x900px.jpg?quality=50&strip=all&w=444)](https://www.csoonline.com/article/3518747/aflacs-shift-to-passkeys-brings-big-business-benefits.html)

[news\
\
**Mastercard acquires Recorded Future: How will threat intelligence transform the payments industry?** \
\
By Taryn Plumb\
\
Sep 12, 20246 mins\
\
Threat and Vulnerability ManagementRisk Management\
\
![Image](https://www.csoonline.com/wp-content/uploads/2024/09/3518765-0-02771600-1726198468-corporate-security-insider-threat-hacker-spy-cybersecurity-human-resources-100938221-orig.jpg?quality=50&strip=all&w=375)](https://www.csoonline.com/article/3518765/mastercard-acquires-recorded-future-how-will-threat-intelligence-transform-the-payments-industry.html)

[news\
\
**Too many companies use non-enterprise grade remote access tools in their OT networks, says Claroty** \
\
By Howard Solomon\
\
Sep 12, 20246 mins\
\
Network SecuritySecurity Practices\
\
![Image](https://www.csoonline.com/wp-content/uploads/2024/09/3518744-0-79760400-1726196732-shutterstock_2091371164.jpg?quality=50&strip=all&w=444)](https://www.csoonline.com/article/3518744/too-many-companies-use-non-enterprise-grade-remote-access-tools-in-their-ot-networks-says-claroty.html)

[podcast\
\
**CSO Executive Sessions: Guardians of the Games - How to keep the Olympics and other major events cyber safe**\
\
Aug 07, 202417 mins\
\
CSO and CISO\
\
![Image](https://www.csoonline.com/wp-content/uploads/2024/08/0-17938700-1723054243-bryan-thumb-16x9-1.jpg?quality=50&strip=all&w=444)](https://www.csoonline.com/podcast/3484298/cso-executive-sessions-guardians-of-the-games-how-to-keep-the-olympics-and-other-major-events-cyber-safe.html)

[podcast\
\
**CSO Executive Session India with Dr Susil Kumar Meher, Head Health IT, AIIMS (New Delhi)**\
\
Jul 17, 202417 mins\
\
CSO and CISO\
\
![Image](https://www.csoonline.com/wp-content/uploads/2024/07/0-24154400-1721221590-CSO_ExecSessions_India_Susil-Meher.jpg?quality=50&strip=all&w=444)](https://www.csoonline.com/podcast/2518505/cso-executive-session-india-with-dr-susil-kumar-meher-head-health-it-aiims-new-delhi.html)

[podcast\
\
**CSO Executive Session India with Charanjit Bhatia, Head of Cybersecurity, COE, Bata Brands**\
\
Jul 08, 202418 mins\
\
CSO and CISO\
\
![Image](https://www.csoonline.com/wp-content/uploads/2024/07/CSO_ExecSessions_India_Charanjit-Bhatia-1-1.jpg?quality=50&strip=all&w=444)](https://www.csoonline.com/podcast/2514504/cso-executive-session-india-with-charanjit-bhatia-head-of-cybersecurity-coe-bata-brands.html)

[video\
\
**CSO Executive Sessions: DocDoc’s Rubaiyyaat Aakbar on security technology**\
\
Sep 12, 202419 mins\
\
Healthcare IndustryArtificial IntelligenceSecurity\
\
![Image](https://www.csoonline.com/wp-content/uploads/2024/09/3518443-0-45328600-1726148016-CSO-rubaiyyaat-thumb-16x9-1.jpg?quality=50&strip=all&w=444)](https://www.csoonline.com/video/3518443/cso-executive-sessions-docdocs-rubaiyyaat-aakbar-on-security-technology.html)

[video\
\
**CSO Executive Sessions: Hong Kong Baptist University’s Allan Wong on security leadership**\
\
Sep 05, 202410 mins\
\
Education IndustryIT Leadership\
\
![Image](https://www.csoonline.com/wp-content/uploads/2024/09/3506248-0-90986000-1725530097-allan-thumb-16x9-1.jpg?quality=50&strip=all&w=444)](https://www.csoonline.com/video/3506248/cso-executive-sessions-hong-kong-baptist-universitys-allan-wong-on-security-leadership.html)

[video\
\
**CSO Executive Sessions: EDOTCO’s Mohammad Firdaus Juhari on safeguarding critical infrastructure in the telecommunications industry**\
\
Sep 05, 202411 mins\
\
Telecommunications IndustryCritical InfrastructureSecurity\
\
![Image](https://www.csoonline.com/wp-content/uploads/2024/09/3506036-0-34893200-1725527717-firdaus-thumb-16x9-1.jpg?quality=50&strip=all&w=444)](https://www.csoonline.com/video/3506036/cso-executive-sessions-edotcos-mohammad-firdaus-juhari-on-safeguarding-critical-infrastructure-in-the-telecommunications-industry.html)

Sponsored Links

- [OpenText Financial Services Summit 2024 in New York City!](http://pubads.g.doubleclick.net/gampad/clk?id=6777769668&iu=/8456/IDG.G_B2B_CSOOnline.com)
- [Visibility, monitoring, analytics. See Cisco SD-WAN in a live demo.](http://pubads.g.doubleclick.net/gampad/clk?id=6778424118&iu=/8456/IDG.G_B2B_CSOOnline.com)

About

- [About Us](https://www.csoonline.com/about-us/)
- [Advertise](https://foundryco.com/our-brands/cso/)
- [Contact Us](https://www.csoonline.com/contact-us/)
- [Foundry Careers](https://foundryco.com/work-here/)
- [Reprints](https://www.csoonline.com/contact-us/#republication-permissions)
- [Newsletters](https://www.csoonline.com/newsletters/signup/)
- [BrandPosts](https://www.csoonline.com/brandposts/)

Policies

- [Terms of Service](https://foundryco.com/terms-of-service-agreement/)
- [Privacy Policy](https://www.csoonline.com/privacy-policy/)
- [Cookie Policy](https://www.csoonline.com/cookie-policy/)
- [Copyright Notice](https://foundryco.com/copyright-notice/)
- [Member Preferences](https://www.csoonline.com/member-preferences/)
- [About AdChoices](https://www.csoonline.com/about-adchoices/)
- [E-commerce Links](https://www.csoonline.com/affiliates/)
- [Your California Privacy Rights](https://www.csoonline.com/your-california-privacy-rights/)
- Privacy Settings

Our Network

- [CIO](https://www.cio.com)
- [Computerworld](https://www.computerworld.com)
- [Infoworld](https://www.infoworld.com)
- [Network World](https://www.networkworld.com)

[Go to Foundry website](https://foundryco.com/)

- [LinkedIn](https://www.linkedin.com/company/csoonline)
- [X](https://twitter.com/CSOonline)
- [Facebook](https://www.facebook.com/CSOonline)

[Copyright © 2024 IDG Communications, Inc.](https://foundryco.com/terms-of-service-agreement/)