Hackers take over supercomputers in Europe to process Monero: report

Getting your Trinity Audio player ready...

The past week has seen some of the most widespread attacks on supercomputers in Europe, with the hackers deploying digital currency processing malware. The attacks were the first of their kind and disrupted research activities in the U.K., Germany, Switzerland and Spain. Security researchers have traced the attacks to compromised networks in China.

The first report of the attack came from the University of Edinburgh in Scotland which runs the ARCHER supercomputer. According to a status report on May 11, the institution noticed a security exploitation on the ARCHER login nodes and decided to disable access to the supercomputer altogether as it investigated the intrusion. At press time, ARCHER is still unavailable, with the university stating that it could resume services later this week.

Similar instances were reported all across Europe. In Germany, bwHPC, an organization responsible for coordinating research projects across supercomputers reported that five of its supercomputers were shut down. Others included the Bavarian Academy of Sciences’ Leibniz Computing Center, the Technical University in Dresden and the Swiss Center of Scientific Computations.

The compromised institutions didn’t divulge much information about the malware. However, the European Grid Infrastructure (EGI) released the malware samples to security researchers. According to the EGI, the attackers coordinated the attacks from two universities in China and one in Poland. The hackers gained access to the supercomputers through compromised secure shell (SSH) credentials.

Once they attacked the system, they would deploy an application that processed privacy coin Monero.

This is the first time that hackers have taken over supercomputers to process digital currencies, and it couldn’t have come at a worse time. Most of the supercomputers under attack have been running simulations aimed at COVID-19 research. Most of them have yet to recover from the attack, dealing a significant blow to the COVID-19 research efforts.

While hackers haven’t taken over supercomputers to process digital currencies in the past, there have been incidences when employees installed the digital currency processors themselves. In Russia, a nuclear scientist was put behind bars for three years in late 2019 on charges of processing digital currencies using his facility’s supercomputers. The scientist was working at the All-Russian Scientific Research Institute of Experimental Physics.