Cryptomining campaign abused free GitHub account trials

Automated abuse

The primary factor in Purpleurchin's success so far, according to Morin, is automation, which has enabled threat actors to continuously create these free accounts to keep the mining operation moving forward.

"There was a lot behind what they did to automate and build this operation," Morin said. "It wasn't just clicking buttons. I think there was a lot of effort put into the back end of this to be able to reap the benefits of the automation once it all started working correctly, and at large scale."

One reason she gave for the cryptomining operation's substantial growth while staying under the radar is that it's not affecting anyone directly or compromising user accounts. Rather, she said, threat actors are simply taking advantage of free opportunities. The blog noted that GitHub offers 2,000 free Action minutes per month.

However, Michael Clark, director of threat research at Sysdig, said that while most legitimate users wouldn't be affected by this threat activity directly, they could be affected in the long run.

"It's going to come back around when [CI/CD service providers] start charging, taking away their free tiers or charging more for their services," Clark said.

Sysdig broke down the potential costs to CI/CD service providers in the blog post, which estimated that every free GitHub account costs the cloud service $15 per month. Free trials at the other companies such as Heroku and Buddy can cost providers between $7 and $10 per month.

"At these rates, it would cost a provider more than $100,000 for a threat actor to mine one Monero," Morin wrote in the blog.

Evasion efforts

Though Monero is a popular cryptocurrency among cybercriminals and particularly ransomware groups, Morin noted in the blog that Purpleurchin mines for other digital currencies, including Tidecoin, Onyx and Bitweb. Sysdig said this move might be calculated because law enforcement agencies watch Monero more closely.

The threat actors behind Purpleurchin also opted for a different mining algorithm than the one most cybercriminals use, which could be a factor for why its activity hadn't been reported until now.

"This is notable because cryptojackers will usually just use XMRig downloaded straight from GitHub, the de facto CPU miner for Monero, whereas Purpleurchin is opting for a CPU miner that gets called via nodejs," Morin wrote. "Our theory here is that the threat actor is choosing these coins based on the yespower algorithm because the mining process can be spawned from said nodejs parent, aiding in evading detection."

Clark said the threat actors have made additional efforts to go undetected by using proxy servers for their cryptomining, moving those servers around and randomizing a lot of names. To make it difficult to connect the free trial accounts to one another, threat actors used OpenVPN software along with the Namecheap VPN network.

For Clark, one major takeaway from the cryptomining campaign was how it highlights the dual use of containers, which benefit legitimate users as well as threat actors. In the case of Purpleurchin, threat actors were using containers for command-and-control infrastructure. "They're really using it as much as everybody else," he said.

Sysdig noted a variety of possible motives behind the operation other than shifting the costs of running cryptominers to the service providers. For example, the threat actors might be preparing to attack the underlying blockchains of certain cryptocurrencies, which have been increasingly targeted recently. In August, threats to cryptocurrency exchanges and decentralized finance platforms became so dire that it warranted a government alert.

Lastly, Morin said the Purpleurchin campaign could be a decoy for other malicious activity, noting that a threat group known as APT32 used cryptomining attacks in conjunction with a cyberespionage campaign in 2020.

While companies including GitHub and Namecheap have tried to curb such abuse with measures such as requiring CAPTCHA when creating an account, she said, threat actors have found tools to get around those obstacles.

Clark added that platforms such as GitHub are in a tough spot because they want to make it frictionless for people to use the site and sign up, and free trials are a big part of that.

"They have to find a balance between too hard and too easy, but it also benefits the attacker because as long as it's not too hard, they'll be able to pull this off," Clark said.

TechTarget Editorial contacted GitHub for comment, but the company had not responded at press time.