Several supercomputers in Europe, including at least one used for COVID-19 research, have been taken offline due to hackers secretly installing cryptocurrency-mining malware on the machines.
A week ago, the Archer supercomputer in the UK and other high-performance computers in Germany and Switzerland shut down in response to a mysterious cyber attack. “We now believe this to be a major issue across the academic community as several computers have been compromised in the UK and elsewhere in Europe,” the Archer’s administrators said.
The security team at EGI, a European supercomputing group, has since discovered the cause: A group of hackers have been stealing remote access to the supercomputers in order to mine a cryptocurrency called Monero.
To gain access, the hackers may have first hijacked computers inside academic institutions that regularly use the supercomputers for research. The same computers would have contained the keys to enable Secure Shell (SSH) remote access to the ultra-powerful computing machines.
“The attacker is hopping from one victim to another using compromised SSH credentials,” EGI said. IP addresses used to host the attacks have been traced back to China, Poland, and Canada, but the connections appear to be occurring over compromised computers, or servers belonging to the Tor Network, making it difficulty to pin down who might be responsible.
Cado Security also investigated a malware sample used in the attacks, and uncovered evidence the hackers managed to place their cryptocurrency-mining software on a US supercomputer. “We are reaching out to them as they may also be compromised,” the company said.
In the meantime, the affected machines in Europe have been trying to boot the hackers out. The Archer supercomputer, which has been hosting tools for COVID-19 research, expects to return to service later this week.
“When Archer returns to service all users will be required to use two credentials to access the service: an SSH key with a passphrase and their Archer password,” the supercomputer told users in an advisory last Friday. “It is imperative that you do not reuse a previously used password or SSH key with a passphrase.”
