Nearly 400 websites running outdated and vulnerable versions of the Drupal content management system, many affiliated with governments and educational institutions, were recently discovered to be infected with Coinhive-based cryptomining software.
In a 5 May post on his "Bad Packets Report" blog site, security researcher Troy Mursch says that the Monero cryptojacking campaign he uncovered compromised 391 sites in total, more than a quarter of which are US-based. Prominent victims included the San Diego Zoo, Lenovo, DLink (Brazil), UCLA, the National Labor Relations Board, the Office of Inspector General of the US Equal Employment Opportunity Commission (EEOC), and the government of Chihuahua, Mexico.
The researcher notes that the attacker was sloppy in that he used a self-signed SSL certificate instead of a trusted one, meaning the payload is not injected using HTTPS. Consequently, in at least some cases, Coinhive failed to load on the sites because the connection to the server was blocked.
Drupal-based websites have emerged as an alluring target for cryptomining campaigns of late, following the discovery of the Drupalgeddon 2.0 vulnerability that was patched last March. It is not clear if the attackers in this case exploited this particular bug, however.
"We've seen plenty examples of Drupalgeddon 2 being exploited in the past few weeks," Mursch writes. "This is yet another case of miscreants compromising outdated and vulnerable Drupal installations on a large scale.