SoK: Cryptojacking Malware

TL;DR

This paper provides a comprehensive survey of cryptojacking malware, highlighting its rise due to cryptocurrency technologies, its impact on various sectors, and the limitations of current detection methods, emphasizing the need for advanced solutions.

Contribution

It offers an extensive analysis of cryptojacking malware, reviewing existing detection techniques, their challenges, and the evolving tactics of attackers, serving as a valuable resource for future research.

Findings

Cryptojacking malware affects diverse sectors including banking, government, and entertainment.

Current detection methods are often bypassed by obfuscation and domain/script changes.

Behavioral and dynamic analysis are crucial for improved detection.

Abstract

Emerging blockchain and cryptocurrency-based technologies are redefining the way we conduct business in cyberspace. Today, a myriad of blockchain and cryptocurrency systems, applications, and technologies are widely available to companies, end-users, and even malicious actors who want to exploit the computational resources of regular users through \textit{cryptojacking} malware. Especially with ready-to-use mining scripts easily provided by service providers (e.g., Coinhive) and untraceable cryptocurrencies (e.g., Monero), cryptojacking malware has become an indispensable tool for attackers. Indeed, the banking industry, major commercial websites, government and military servers (e.g., US Dept. of Defense), online video sharing platforms (e.g., Youtube), gaming platforms (e.g., Nintendo), critical infrastructure resources (e.g., routers), and even recently widely popular remote video conferencing/meeting programs (e.g., Zoom during the Covid-19 pandemic) have all been the victims of powerful cryptojacking malware campaigns. Nonetheless, existing detection methods such as browser extensions that protect users with blacklist methods or antivirus programs with different analysis methods can only provide a partial panacea to this emerging cryptojacking issue as the attackers can easily bypass them by using obfuscation techniques or changing their domains or scripts frequently. Therefore, many studies in the literature proposed cryptojacking malware detection methods using various dynamic/behavioral features.