Shalini Nagarajan

Dubai’s crypto regulator has published its eagerly-anticipated regulations for the local industry — including an effective ban on anonymity-focused digital assets known as privacy coins.



The emirate’s Virtual Assets Regulatory Authority (VARA) released its <a href="https://www.vara.ae/media/Virtual%20Assets%20and%20Related%20Activities%20Regulations%202023.pdf" target="_blank" rel="noreferrer noopener">rulebook</a> on Tuesday. It  includes 10 fundamental principles and goals including licensing requirements, anti-money laundering obligations, stipulations on marketing and promotion and offenses like insider dealing.



VARA describes anonymity-enhanced cryptocurrencies as assets which prevent the tracking of ownership or transactions — an impediment for which crypto service providers currently have no way to effectively mitigate.



Dubai’s new <a href="https://www.vara.ae/media/Virtual%20Assets%20and%20Related%20Activities%20Regulations%202023.pdf" target="_blank" rel="noreferrer noopener">rule</a> means cryptocurrencies such as <a href="https://blockworks.co/news/crypto-mixers-and-privacy-coins-can-they-resist-censorship">Zcash (ZEC) and Monero</a> (XMR) won’t be allowed, nor can local entities create such coins. 



Japan similarly banned privacy coins in 2019 while a string of <a href="https://www.coindesk.com/markets/2019/11/26/another-crypto-exchange-is-dropping-privacy-coin-monero-over-compliance-risk/" target="_blank" rel="noreferrer noopener">exchanges</a> have delisted some offerings over the past few years, including Huobi and BitBay. Coinbase shed ZEC in the UK in 2019 and has so far avoided listing XMR altogether.



Among other rules, entities can’t describe themselves as virtual asset businesses unless they are licensed by the VARA to do so. Large proprietary traders that actively invest $250 million or more in crypto must register with the VARA.



Reasons for license revocation include violation of any directive or if an entity is insolvent. The regulator also sets fees for various services, in the range of 40,000 dirhams ($10,889) to 200,000 ($54,449) dirhams.



Violating rules related to market conduct can lead to fines of up to 20 million dirhams ($5.4 million) for individuals and up to 50 million dirhams ($13.6 million) for a virtual asset service provider, such as exchanges or payment processors.



The VARA’s regulations apply to virtual asset businesses and activities within the emirate of Dubai, including special development zones and free zones, but exclude the Dubai International Financial Centre which has its own regulator.



A recent report showed Dubai has attracted more than <a href="https://blockworks.co/news/dubai-free-zone-now-home-to-more-than-500-crypto-startups">500 crypto companies</a> to its digital asset ecosystem. But crypto-friendliness hasn’t exactly meant that the wealthy Middle Eastern city has been easy on new businesses wanting to set up shop.&nbsp;



Tim Buyn, global government relations officer at OKX’s parent firm, <a href="https://blockworks.co/news/crypto-seeks-freedom-in-the-uae-is-it-a-regulatory-rug-pull">told Blockworks</a> in August that the due diligence process “has easily over 100 data items or documents” that need to be turned in.



The VARA’s ambitions include positioning Dubai as a regional and international hub for virtual assets in a manner that would boost its competitive edge locally and internally. It also hopes that its business-friendly regulatory landscape would attract investments and motivate businesses to set up their operations in Dubai.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Privacy Coins To Be Banned in Dubai

Sebastian Sinclair

<div id="highlights-block_630f28259bd10" class="highlights">
 <ul>
 <li>Nitrokod is currently featured at the top of Google search results for popular apps, including Translate</li>
 <li>The malware maliciously mines monero using users&#8217; computer resources, echoing once-prolific CoinHive</li>
 </ul>
 
</div>



An insidious malware campaign targeting users searching for Google applications has infected thousands of computers globally to mine <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">privacy-focused crypto</a> monero (XMR).



You’ve probably never heard of Nitrokod. Israeli-based cyber intelligence firm Check Point Research (CPR) stumbled upon the malware last month.&nbsp;



In a <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">report on Sunday</a>, the firm said Nitrokod initially masks itself as a free software, having found remarkable success at the top of Google search results for “Google Translate desktop download.”



Also known as cryptojacking, mining malware has been used to infiltrate unsuspecting user’s machines since at least 2017, when they rose to prominence alongside crypto’s popularity.



CPR previously detected well-known cryptojacking malware CoinHive, which also mined XMR, in November of that year. CoinHive was said to be stealing <a href="https://www.checkpoint.com/press/2017/cryptocurrency-mining-presents-new-threat-business-says-check-point/" target="_blank" rel="noreferrer noopener">65% of an end-user’s total CPU resources</a> without their knowledge. Academics <a href="https://thenextweb.com/news/coinhive-mining-monero-profits" target="_blank" rel="noreferrer noopener">calculated</a> the malware was generating $250,000 per month at its peak, with the bulk of it going to less than a dozen individuals.



As for Nitrokod, CPR believes it was deployed by a Turkish-speaking entity sometime in 2019. It operates across seven stages as it moves along its path to avoid detection from typical antivirus programs and system defenses.&nbsp;



“The malware is easily dropped from software found on top Google search results for legitimate applications,” the firm wrote in its report. 



Softpedia and Uptodown were found to be two major sources of fake applications. Blockworks has reached out to Google to learn more about how it filters these kinds of threats.



<figure class="wp-block-image size-full"><img decoding="async" loading="lazy" width="935" height="445" src="https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp" alt="" class="wp-image-29655" srcset="https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=935 935w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=300 300w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=768 768w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=428 428w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=470 470w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=389 389w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=80 80w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=50 50w" sizes="(max-width: 935px) 100vw, 935px" /><figcaption>Image source: <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">Check Point Research</a></figcaption></figure>



After downloading the application, an installer executes a delayed dropper and continuously updates itself on every restart. On the fifth day, the delayed dropper extracts an encrypted file.&nbsp;



The file then initiates Nitrokod’s final stages, which sets about scheduling tasks, clearing logs and adding exceptions to antivirus firewalls once 15 days have ticked by.



Finally, crypto mining malware “powermanager.exe” is surrepticiously dropped onto the infected machine and sets about generating crypto using open source Monero-based CPU miner XMRig (the same one used by CoinHive).



“After the initial software installation, the attackers delayed the infection process for weeks and deleted traces from the original installation,” the firm wrote in its report. “This allowed the campaign to successfully operate under the radar for years.”



Details of how to clean machines infected with Nitrokod can be found at the <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">end of CPR&#8217;s threat report</a>.



Learn More: <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">Can Crypto Mixers and Privacy Coins Resist Censorship?</a> 



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">