How Crackonosh malware made millions in crypto

Gamers, beware: according to new reports, a Windows malware named Crackonosh (that’s ​“mountain spirit” in Czech folklore, if you were wondering) has been stealthily infecting over 222,000 computers worldwide since 2018. At the time of writing, the rogue developer behind the scam has made at least 9000 Moneros – a cryptocurrency renowned for giving users an unprecedented amount of privacy. That’s almost £1.5 million.

Crackonosh operates by infiltrating gaming forums and posting free versions of popular games such as Grand Theft Auto V, NBA 2K19 and Pro Evolution Soccer 2018. A hard bargain to turn down, for sure, but how has Crackonosh made so much money?

Hidden inside each game is a piece of crypto-mining malware that secretly generates digital currency once the game has been downloaded. Known as ​“mining”, this is usually performed by high-powered computers that solve complex computational problems, particularly when it comes to Bitcoin – an aspect of this currency revolution which has already raised alarming questions about crypto’s impact on the environment.

In theory, you could do this at home, but it would seriously run up your electricity bill – which is exactly what’s happened to Crackonosh victims, who are effectively being used as Monero mining pawns without their knowledge.

So far, in the UK, at least 8946 people have been affected by the scam. Once Crackonosh gets its claws into software, it disables all Windows updates and uninstalls all security software, with the mining programme constantly running in the background.

According to cyber-security company Akamai, there’s been a 340 per cent increase in attacks on gaming brands and gamers since 2019. ​“Gamers are a demographic known for spending money on their hobby and they’re highly engaged,” says Steve Ragan, an Akamai security researcher, ​“making them a consistent resource for the criminal economy to mine.”

You have been warned.