Monero Coin (XMR)

10th November 2021 | Cybrary

Monero Coin (XMR) is a cryptocurrency focused on ‘Privacy and Anonymity’. The privacy token runs on its own blockchain, which hides virtually all transaction details. The identity of the sender and recipient, as well as the transaction amount itself, are hidden. Because of these anonymity features, Monero allows cybercriminals greater freedom and privacy from the public blockchain that bitcoin uses. Monero has become widely used in many Ransomware-As-A-Service (RAAS) tools purchased on the Dark Web. REvil, for example, has been giving discounts to its ransomware victims if they complete their ransom payment in Monero.

Cybercriminals had a wake-up call after the FBI successfully breached a cryptocurrency wallet held by the Colonial Pipeline hackers by following the money trail on bitcoin’s public blockchain wallet addresses. The FBI bitcoin recovery proved to hackers that Bitcoin is ‘traceable’. Hackers have already started updating their tools to use a privacy-enhanced cryptocurrency called Monero Coin. With Monero coin hackers have a greater degree of privacy-protecting them from a similar fate to the FBI Bitcoin recovery.

Recommendations for Cryptocurrency Investors

Before you invest in Monero Coin, you should consider the potential for regulators of cryptocurrency exchanges to shut down the use of Monero coin. Given the extreme privacy of this cryptocurrency, there will be great pressures to shut down or prevent the conversion of Monero Coin into hard currencies like US dollars, goods, or services.

Cryptocurrency Best Practices

It’s a relief the FBI has the ability to recover funds in some cases, but you shouldn’t expect to get your money back as Colonial did. With that said, there are certain things you should be doing in light of these events:

Don’t put all your crypto coins in hot wallets. When you entrust your savings or your wage payments to a bank, you are doing so with years of regulatory scrutiny and protection to back you up. In the unregulated cryptocurrency world, you are largely on your own if something goes wrong. Don’t keep more than you can afford to lose in a hot wallet.
Don’t expect to keep a secret such as a Bitcoin password or ATM PIN if you tell it to other people. As Benjamin Franklin is supposed to have said, “Three people can keep a secret if two of them are dead.” Remember: If in doubt, don’t give it out.

Recommendations for Business Owners

There’s really no change in the recommendations for business owners based upon this event. You still do not want to be hit with ransomware regardless of whether it uses Bitcoin or Monero coin. It’s still a bad event that disrupts your business. Take CyberHoot’s recommendations below to protect your business as always.

Don’t keep all your data online all the time. Ironically, perhaps, one important defense against ransomware in the first place is to maintain an offline backup, ideally one that is also off-site. Keeping your crypto coins, as well as any truly private or critical data, offline – is a similarly useful precaution.
Alternatively, choose a backup solution with time-based versioning enabled. This allows a business to restore their data from a version prior to the ransomware event occurring.
Don’t expect to get your money back as Colonial Pipeline did. You need to think of crypto coin recovery as a rare exception, not as a common rule. As explained above, it typically requires a high-profile case, plus strong operational intelligence, plus a bit of plain old luck, for law enforcement to achieve a result like this.

Additional Best Practices for Minimum Essential Cybersecurity

In addition to these cryptocurrency-specific actions, your company needs to take proactive measures to first reduce its chances of being hit by ransomware. CyberHoot recommends the following best practices to avoid, prepare for, and prevent damage from these attacks:

Adopt two-factor authentication on all critical Internet-accessible services
Adopt a password manager for better personal/work password hygiene
Require 14+ character Passwords in your Governance Policies
Follow a 3-2-1 backup method for all critical and sensitive data
Train employees to spot and avoid email-based phishing attacks
Check that employees can spot and avoid phishing emails by testing them
Document and test Business Continuity Disaster Recovery (BCDR) plans
Perform a risk assessment every two to three years

Start building your robust, defense-in-depth cybersecurity plan at CyberHoot.

To learn more about Monero, watch this short video:

Sources:

CNBC

Investopedia

Kraken

Additional Reading:

Monero – The New Crypto For Hackers

Related Terms:

Bitcoin

Cryptocurrency Wallet

CyberHoot does have some other resources available for your use. Below are links to all of our resources, feel free to check them out whenever you like:

Blog
Cybrary (Cyber Library)
Infographics
Newsletters
Press Releases
Instructional Videos (HowTo) – very helpful for our SuperUsers!

Note: If you’d like to subscribe to our newsletter, visit any link above (besides infographics) and enter your email address on the right-hand side of the page, and click ‘Send Me Newsletters’.