What Is Swisscoin? Botnet Carries Out Pump And Dump Of Obscure Cryptocurrency

The world’s largest botnet used for spam is getting in on the cryptocurrency craze. Recent reports have pinned a massive influx of emails touting an obscure cryptocurrency called Swisscoin to the Necurs botnet.

Over the course of the last week, security researchers have spotted the spam network sending out millions of spam emails attempting to convince recipients to invest in Swisscoin, a mostly unknown cryptocurrency currently valued at a fraction of a cent.

The campaign utilizing Necurs appears to be a so-called “pump and dump” scheme, in which the scammers attempt to gin up interest in a product to increase its value, only for those hyping it up to sell off their shares and profit off the short-term gains.

In this particular campaign, the product is Swisscoin—an essentially unknown cryptocurrency that has thus far generated little interest. According to CoinMarketCap , Swisscoin is currently valued at $0.00356 and has a market capitalization (the amount of fiat currency invested in it) of just $64,000. By comparison, Bitcoin has a market cap of more than $190 billion.

Little is known about Swisscoin, and the cryptocurrency’s website provides little clarification. It was first released in 2016 by two entrepreneurs and is described as a “promising and ambicious [sic] project” by its creators. New information has not been released about Swisscoin since October 2017.

Swisscoin has a dubious history and has been accused of being nothing more than a ponzi scheme. Researchers have claimed the digital token operates like a multi-level marketing scheme and has no actual technical backing but is rather just a clone of other digital tokens.

Drawing connections between the cryptocurrency and the operators of the Necurs botnet is a challenge and there does not appear to be a direct link, but the operators of the spam network have clearly taken a particular interest in Swisscoin.

Malware and botnet tracker abuse.ch reported Necurs, largely dormant for last month, has suddenly ramped up activity again and sent more than a quarter of a million emails to victims on January 16. Interestingly, those emails did not contain attachments, which they typically would if it was being used to infect machines with malware.

Instead, the emails all appear to be promoting Swisscoin and doing little else. Titles on the emails all served to generate excitement and interest in the cryptocurrency and included lines like “This crypto coin could go up fifty thousand percent this year,” “Let me tell you about one crypto currency that could turn 1000 bucks into 1 million” and “Forget about bitcoin, there's a way better coin you can buy.”

Trading on Swisscoin had previously been halted but reopen on January 15, the same day that spam messages from Necurs mentioning the coin began. The coin has actually lost value since the campaign began.

BleepingComputer reported the Swisscoin campaign was the first instance of Necurs—a botnet consisting of hundreds of thousands of internet-connected devices that have been infected with malware and used to launch targeted campaigns—being used to promote a cryptocurrency. The network is typically used to distribute malware.