The Citizen Lab, an interdisciplinary laboratory at the University of Toronto, published a report on Friday strongly suggesting that Egypt has been mining cryptocurrency secretly on its citizens' computers. The report explained that Sandvine/Procera Networks Deep Packet Inspection (DPI) devices were used "to covertly raise money through affiliate ads and cryptocurrency mining in Egypt."

Sandvine Corporation was acquired in September of last year by private equity firm Francisco Partners, which bought Procera Networks in 2015. Sandvine and Procera Networks then merged and have been producing a website-filtering software called Packetlogic which the report says "may have been used by government-linked entities in both Turkey and Egypt to inject spyware."

In addition, the Lab also found that the software is installing at least one cryptocurrency mining script, Coinhive, which is readily available for mining the privacy-centric cryptocurrency monero (XMR).

Detection method

Through a process that began with scanning all of the IP addresses in certain countries, the researchers found DPI devices called middleboxes that intercept traffic on Turk Telekom's network between the public and various unencrypted websites.

These devices were "used to redirect hundreds of users in Turkey and Syria to nation-state spyware when those users attempted to download certain legitimate Windows applications," the researchers elaborated. In Egypt, the team found more than just spyware, stating: