A new cryptocurrency mining malware uses leaked NSA exploits to spread across enterprise networks
Two years after highly classified exploits built by the National Security Agency were stolen and published, hackers are still using the tools for nefarious reasons.
Security researchers at Symantec say they’ve seen a recent spike in a new malware, dubbed Beapy, which uses the leaked hacking tools to spread like wildfire across corporate networks to enslave computers into running mining code to generate cryptocurrency.
Beapy was first spotted in January but rocketed to more than 12,000 unique infection across 732 organizations since March, said Alan Neville, Symantec’s lead researcher on Beapy, in an email to TechCrunch. The malware almost exclusively targets enterprises, host to large numbers of computers, which when infected with cryptocurrency mining malware can generate sizable sums of money.
The malware relies on someone in the company opening a malicious email. Once opened, the malware drops the NSA-developed DoublePulsar malware to create a persistent backdoor on the infected computer, and uses the NSA’s EternalBlue exploit to spread laterally throughout the network. These are the same exploits that helped spread the WannaCry ransomware in 2017. Once the computers on the network are backdoored, the Beapy malware is pulled from the hacker’s command and control server to infect each computer with the mining software.
Not only does Beapy use the NSA’s exploits to spread, it also uses Mimikatz, an open-source credential stealer, to collect and use passwords from infected computers to navigate its way across the network.
According to the researchers, more than 80 percent of Beapy’s infections are in China.
Hijacking computers to mine for cryptocurrency — known as cryptojacking — has been on the decline in recent months, partially following the shutdown of Coinhive, a popular mining tool. Hackers are finding the rewards fluctuate greatly depending on the value of the cryptocurrency. But cryptojacking remains a more stable source of revenue than the hit-and-miss results of ransomware.
In September, some 919,000 computers were vulnerable to EternalBlue attacks — many of which were exploited for mining cryptocurrency. Today, that figure has risen to more than a million.
Typically cryptojackers exploit vulnerabilities in websites, which, when opened on a user’s browser, uses the computer’s processing power to generate cryptocurrency. But file-based cryptojacking is far more efficient and faster, allowing the hackers to make more money.
In a single month, file-based mining can generate up to $750,000, Symantec researchers estimate, compared to just $30,000 from a browser-based mining operation.
Cryptojacking might seem like a victimless crime — no data is stolen and files aren’t encrypted, but Symantec says the mining campaigns can slow down computers and cause device degradation.
Rothschilds Liquidating Royal Heirlooms In Historic Auction
The Rothschild banking family is auctioning off furniture and artifacts which once belonged to European monarchies, according to Bloomberg, which calls the July 4th liquidation a "royal summer yard sale."
Members of the storied clan, whose extravagant style influenced generations of the mega-rich, consigned about 57 lots to Christie’s July 4 auction in London. The trove is estimated at about 10 million pounds ($12.9 million). -Bloomberg
"There’s something mythical about the Rothschilds that’s attached to whatever they owned," said New York interior designer Robert Couturier. "They created their own world of taste and elegance. There’s an abandon of luxury that few other families had."
The 'crown jewels' of the collection are a pair of Flemish-made giltwood cabinets commissioned by King Philip V of Spain around the year 1713. They're estimated to bring in 1.5 to 2.5 million pounds ($1.9 - $3.2 million US).
Philip V cabinets (photo: Christie's)
Also up for sale is a mahogany writing desk crafted for Marie Antoinette around 1780 by Jean Henri Riesener, whose work exemplified the "Louis XVI" style. Reisener was paid by the French Crown "with a lavishness unknown since the days of Louis XIV," receiving some 900,000 livres between 1775 - 1784 (roughly $23 million USD) while he was also working for private clients.
The desk may fetch as much as 1 million pounds ($1.3 million USD), according to the report.
Jean Henri Riesener
The lavish style is known as le gout Rothschild and became the hallmark of the American Gilded Age, influencing the Rockefellers, Astors and Vanderbilts. The family was known to buy only the best of what was on the market. After the French Revolution in 1789, many pieces from the Palace of Versailles entered their collection. -Bloomberg
A rectangular parcel-gilt, gilt-bronze and rock-crystal casket, Venetian, circa 1600. Estimate: £100,000-150,000. Offered in Masterpieces from a Rothschild Collection on 4 July at Christie’s London
That said, the ornate aesthetic of many of the pieces has fallen somewhat out of fashion, according to the report, which notes that people pay more for a picture of the 'Kimpsons,' such as this one which sold for $2.6 million to a young Chinese buyer.
UNTITLED (KIMPSONS #3), 2003 -- Sold for $2.6 million on April 1, 2019
"Taste changes. Times change. Houses change," said Couturier. "It is an era that has definitely passed."
That said, the Rothschild name should appeal to plenty of Christie's clients, particularly in Europe - according to the auction house's head of European furniture, Paul Gallois. Also interested are buyers from Russia, Asia and the Middle East.
Another featured item is artist Jean-Honore Fragonard's Dans les bles, which is estimated at 700,000 to 1 million pounds ($900,000 - $1.3 million USD) - though it appears to have failed to sell at Sotheby's in 2015 for more than twice as much - as well as an 18th century sundial believed to have been commissioned by King Louis XV, estimated at 60,000 - 80,000 pounds ($77,000 - $103,000).
Dans les bles
The Rothschilds don’t sell often, Gallois said. In 2015, Eric de Rothschild sold a pair of Rembrandt portraits to the governments of France and the Netherlands for $180 million. The collection of barons Nathaniel and Albert von Rothschild was sold by Christie’s in 1999, with a royal commode by Riesener fetching 7 million pounds. It’s now on view at Versailles, according to Christie’s. -Bloomberg
Christie's has not disclosed which Rothschild family members are selling in July.
"Most of the houses were filled with such splendors," said Couturier. "They could come from any of the Rothschilds’ homes."
Separate of the auction, the Louvre has agreed to buy Rembrandt van Rijn's The Standard Bearer (1636) from the Rothschilds for an undisclosed sum, after France declared it to be a "national treasure." The museum has 30 months to find the necessary funds, accordsing to The Art Newspaper.
When Jacob James de Rothschild bought The Standard Bearer for £840 in 1840 at a Christie’s sale in London, it was perhaps the earliest purchase of a Rembrandt by a member of the banking family. The work was inherited by his son Edmond de Rothschild, who donated a collection of 40,000 prints and 3,000 drawings to the Louvre, including a selection of Rembrandt’s etchings and drawings, in 1935. The painting, which was previously in the collection of the English monarch King George IV, now belongs to the children of Élie de Rothschild, who died in 2007. -The Art Newspaper
Rembrandt's The Standard Bearer (1636) Image via Wikicommons
Walmart could pursue IPO of Asda division
Walmart Inc.[NYSE:WMT] is looking into the possibility of spinning off its Asdadivision, and could pursue an initial public offering for the unit, according to a newswire report.
Bloomberg cited people familiar in reporting the news today, noting that the exploration comes following the collapse of plans to join the unit with J Sainsbury Plc [LON: SBRY]. The merger would have created the biggest supermarket chain in the UK. The merger was blocked by antitrust regulators, the article noted.
Bloomberg reported that Walmart is not under immediate pressure to make a decision on Asda, as its performance has improved recently.
The article reported that Walmart could revisit the possibility of selling Asda, and one source told Bloomberg that Walmart could decide to retain the business.
Link to original source
Asian Companies Pull Back From Iran Amid U.S. Pressure
European officials fear the Asian retreat lessens Iran’s incentive to remain in nuclear deal
Asian companies that had provided a lifeline to Iran after the U.S. reimposed sanctions last year are pulling back, hurting the hobbled Iranian economy and leaving the Islamic Republic with less incentive to stay committed to a multination nuclear deal, Western diplomats say.
The companies are reacting to the Trump administration’s moves this month to squeeze Iran’s oil exports and impose a terror designation on its paramilitary force. Among Asian businesses rethinking their dealings with Iran are banks, oil companies and technology giants including Huawei Technologies Co., Lenovo Group , LG Electronics Inc. and Samsung Electronics Co.
Many deals between Iran and Chinese companies “are now dead in the water,” said an adviser to a Chinese oil company in Iran. “No one wants to take the risk of going out of business.”
Last year, the Trump administration pulled out of the 2015 agreement that lifted sanctions on Iran in exchange for tightened control on its nuclear program.
Tehran pinned its hopes on China and other Asian nations when European companies began withdrawing from its economy ahead of the U.S.’s reinstatement of sanctions last fall. During the earlier sanctions period before the nuclear agreement’s approval, China overtook Europe as Iran’s chief supplier of industrial equipment.
But this week, Iran’s main means of payment—the direct exchange of oil for goods and services—came under abrupt threat when the U.S. State Department said it would end waivers for all buyers of Iranian oil.
The move means any company importing oil from Iran after the current round of waivers expires on May 2 could be blocked from the American banking system.
Until now, Washington had allowed eight jurisdictions, including China, India and South Korea, to purchase Iranian oil as long as they committed to reducing their imports.
The Trump administration’s tightening of the ban came two weeks after Washington raised the risks for companies doing business with Iran by designating the Islamic Revolutionary Guard Corps a terrorist organization. The Guard Corps plays a significant role in Iran’s economy, including its energy industry.
The reaction from buyers of Iranian oil has been mixed. India has said it would likely abide by the U.S. rules but China’s foreign ministry has taken a defiant tone, saying Beijing “consistently opposes U.S. unilateral sanctions.”
Experts expect that China will continue to buy some Iranian oil, but many Chinese businesses are limiting their exposure to the country. Bank of Kunlun Co., a key conduit for Sino-Iranian trade, told clients on Monday that it will stop all transfers with Iran beginning May 1, said Mostafa Pakzad, a Tehran-based consultant who helps companies carry payments in and out of Iran.
The bank, owned by state-run China National Petroleum Corp., had already interrupted such dealings last year but had restarted trade of humanitarian goods in the hope they could be exchanged for Iran oil.
Monthly Chinese exports to Iran stood at $629 million in March, down from a monthly average of $1.6 billion from 2014 to early 2018, according to China’s General Administration of Customs.
The prospect of reduced oil imports from Iran—along with rising U.S. pressure—has led to a more concerted scaleback from China in recent weeks.
Late last month, Pang Sen, the Chinese ambassador to Iran, and other diplomats met with Iranian business people in Tehran, including consumer electronics distributors. The message, according to Iranian business people briefed on the gatherings: China has no plan to increase its exposure to Iran.
China Foreign Ministry spokesman Geng Shuang said he wasn’t aware of the ambassador’s conversations but said “the normal cooperation between China and Iran must be respected and protected.”
Multibillion-dollar projects in oil and gas fields and railways granted to Chinese state-run giants are now under threat, according to Iranian business executives and the Chinese oil-company adviser.
Also in March, Huawei, the world’s second-largest smartphone maker, laid off most of its 250 staff in Iran, according to businessmen in Tehran. And Beijing-based Lenovo, the world’s largest computer manufacturer, banned its Dubai-based distributors from selling to Iran after a warning from the U.S. Treasury Department, these people said.
A Lenovo spokeswoman said the company has a firm policy of complying with export regulations but declined to comment further. A Treasury spokesman declined to comment.
Huawei has come under heavy pressure from Washington—which alleges the company violated international banking sanctions on Iran—and the dispute has turned into a major point of contention between the Trump administration and Beijing.
South Korean consumer-electronics giants Samsung and LG already have reduced exposure to Iran and are consulting with government officials in Seoul to determine whether they must withdraw from the nation entirely following the end of U.S. oil waivers, according to business people in Tehran who work with the companies.
Iran had been financing purchases from both companies with funds generated from the sale of oil and crude-based products.
A Samsung spokesman said he couldn’t immediately comment. Huawei and LG didn’t respond to requests for comment.
European officials say Beijing has appeared willing to slow trade with Iran in return for concessions from Washington in the continuing trade fight between the U.S. and China. Beijing has been locked in a dispute with the Trump administration over bilateral commercial tariffs and intellectual property.
“The Chinese are very committed” to the Iranian nuclear deal in principle, said one senior European diplomat. “But their overarching objective is of course their relationship on trade with the U.S.”
Gilead Sciences announces that STELLAR-3 study of selonsertib for patients with bridging fibrosis due to NASH did not meet the pre-specified week 48 primary endpoint
In the study of 802 enrolled and dosed patients, 9.3 percent of patients treated with selonsertib 18 mg (p=0.42 versus placebo) and 12.1 percent of patients treated with selonsertib 6 mg (p=0.93) achieved a = 1-stage improvement in fibrosis according to the NASH Clinical Research Network (CRN) classification without worsening of NASH after 48 weeks of treatment, versus 13.2 percent with placebo. Selonsertib was generally well tolerated and safety results were consistent with prior studies
Freeport-McMoRan misses by $0.03, reports revs in-line; raises operating cash flows guidance to ~$2.3 bln for the year 2019, up from $1.8 bln (13.58)
- Reports Q1 (Mar) earnings of $0.05 per share, $0.03 worse than the S&P Capital IQ Consensus of $0.08; revenues fell 22.1% year/year to $3.79 bln vs the $3.77 bln S&P Capital IQ Consensus
- First-quarter 2019 copper sales of 784 million pounds and gold sales of 242 thousand ounces were approximately five percent lower than January 2019 sales estimates of 825 million pounds of copper and 255 thousand ounces of gold, reflecting impacts from weather events at El Abra, unscheduled maintenance in North America and timing of shipments in Indonesia
- Freeport-McMoRan rasises operating cash flows guidance to expected to approximate $2.3 billion for the year 2019, up from $1.8 bln
- Capital expenditures are expected to approximate $2.5 billion for the year 2019, including $1.5 billion for major mining projects primarily associated with underground development activities in the Grasberg minerals district and development of the Lone Star project, and exclude estimates associated with the new smelter in Indonesia
Gapping down
In reaction to disappointing earnings/guidance:
- PRLB -13.1%, XLNX -9.8%, PTC -8.7% (also appoints Kristian Talvitie as CFO), MMM -8.6%, NOK -8.1%, XRX -7.6%, NTGR -7.3%, SAVE -6.5%, CUZ -5%, ORLY -4.6%, DHI -3.6%, ADS -3.5%, MO -3.3%, MAS -3%, BCS -2.9%, BC -2.7%, UPS -2.6%, QEP -2.5%, ALGN -2.4%, ROK -2.2%, ECHO -2.1%, SSTK -2%, CMCSA -2%, HZO -1.9%, PKG -1.8%, AB -1.7%, BAX -1.7%, ARI -1.5%, VC -1.5%, AGNC -1.3%, RTN -1.3%, HBAN -1.1%, OMAB -0.8%, TSLA -0.7%
Other news:
- MMLP -21.2% (announces strategic initiatives, reports Q1 results, and cuts dividend)
- GRTS -5.4% (prices 6.5 mln shares of common stock at $11.50 per share)
- PBFX -3.1% (reports prelim Q1 results with plans to acquire the remaining 50% interest in Torrance Valley Pipeline Company ; announces registered direct offering of 6,585,500 common units for gross proceeds of ~$135.0 mln)
- PCG -1.7% (confirms will report first-quarter 2019 earnings on May 2)
- WMT -0.5% (UK CMA blocks merger between J Sainsbury (JSAIY) and Asda, unit of WMT)
Analyst comments:
- CYBR -1.6% (downgraded to Neutral from Buy at UBS)
- MTSI -0.9% (downgraded to Hold from Buy at Jefferies)
- OC -0.9% (downgraded to Sell from Neutral at Seaport Global Securities)
Gapping up
In reaction to strong earnings/guidance:
- BCOV +11.2%, FBHS +10.3%, GNC +9.8%, FB +9%, SAM +8.9%, AXTI +7.8%, MSFT +4.9%, WAB +4.5%, LRCX +4.4%, NCI +4.4%, CHDN +4.2%, HSY +4.2%, KN +4%, NOW +4%, GFI +3.6%, IP +3.5%, MDCO +3.4%, CVI +3.2%, AZPN +3%, CLF +2.9%, BWA +2.3%, WPG +2%, PYPL +2%, YNDX +2%, LUV +2%, TAK +2%, ABBV +2%, LKQ +1.8%, LLEX +1.8%, SHOO +1.8%, IRM +1.7%, WCN +1.6%, DRE +1.4%, PDS +1.4%, BMY +1.3%, BBD +1.2%, VLO +1.2%, MEOH +1.1%, UAN +1.1%, TAL +1.1%, ROP +1%, CLB +0.8%, UFPI +0.8%, WM +0.8%, SUI +0.7%, NEM +0.7%, CMG +0.6%
Other news:
- QTNT +13.8% (Quotient reports "positive" initial EU field trial performance data for MosaiQ Serological Disease Screening Microarray)
- MAXR +6.1% (to collaborate with NTT DATA and Toyota Research Institute to build high-definition maps for autonomous vehicles from space)
- ACRS +5.3% (submits IND to FDA for ATI-450)
- AMAT +2.8% (following LRCX results)
- ZUO +2.7% (following CEO appearance on CNBC's Mad Money)
- ZM +2% (rebounding from Wednesday's 8% decline; Cboe Global Markets plans listing of options on April 25)
- SFLY +1.2% (following afternoon move higher on reports of PE interest)
- TELL +1% (discloses entry into master liquefied natural gas sale and purchase agreement and related confirmation notices with an unrelated third-party LNG merchant)
Analyst comments:
- NVS +1.8% (upgraded to Buy from Neutral at Guggenheim)
- WYNN +1.8% (upgraded to Buy from Neutral at BofA/Merrill)
- LAD +1.5% (upgraded to Overweight from Equal-Weight at Stephens)
- AXP +1.2% (upgraded to Overweight from Equal-Weight at Morgan Stanley)
Altria misses by $0.03, misses on revs; guides FY19 EPS in-line (54.71)
- Reports Q1 (Mar) earnings of $0.90 per share, $0.03 worse than the S&P Capital IQ Consensus of $0.93; revenues fell 6.0% year/year to $4.39 bln vs the $4.6 bln S&P Capital IQ Consensus.
- Co issues in-line guidance for FY19, sees EPS of $4.15 to $4.27 vs. $4.22 S&P Capital IQ Consensus.