During the investigation, the digital department at 1+1 found that a hidden Coin-hive script for Monero mining was loaded from the api.traq.li domain into the browsers of news websites’ readers via the Newzmate API. In this way, fraudsters made profits by exploiting computer resources without users’ permission. The experts of 1+1 Media removed mining tools from all of the Group’s websites after their detection. 

The concealed Coin-hive script penetrated the media group’s websites after a content recommendation e-mail service called Traqli was purchased. The service is owned by Newzmate.

The editorial office of TSN.ua (a 1+1’s media asset, a leading Ukrainian news site) was offered a free use of the service, with the condition to install the script for cryptocurrency mining. Despite the offer being rejected, the mining scrypt penetrated the group’s websites.

Such actions fall under Article 361 of the Criminal Code of Ukraine (Unauthorized interference in electronic computing machines (computers), automated systems, computer networks or telecommunication networks). The relevant report was filed with the Cyber Police Department of the National Police of Ukraine.

It should be recalled that in late September 2017, other incidents were reported when Ukrainian online media platforms were secretly used for concealed mining of cryptocurrency. Then the crypt for Monero mining was revealed on football.ua, Korrespondent.net, iSport.ua tochka.net, and other websites.

1+1 Media recommends that other media companies remain vigilant and systemically check the codes of their news websites advertising modules for third-party software.