CoinMiner

CoinMiner is a broad cryptocurrency-mining malware family name used for malicious miners that monetize compromised systems by hijacking compute resources. It is most commonly associated with Windows intrusions, where it has been observed spreading laterally through Windows Management Instrumentation and, in some reporting, EternalBlue-enabled propagation. CoinMiner variants commonly establish persistence through WMI Standard Event Consumer scripting and are frequently deployed after initial compromise rather than serving as the first-stage payload.

Operationally, CoinMiner appears across multiple intrusion types and criminal ecosystems. It has been delivered by other malware families and loaders, including services such as TrickGate and botnets such as Amadey, and has also appeared in opportunistic compromises of exposed services such as internet-facing MS-SQL servers. In those cases, attackers have used CoinMiner as an immediate monetization payload while retaining the option to escalate to broader post-compromise activity, including privilege escalation, remote access tooling, credential theft by companion malware, or ransomware deployment. CoinMiner has also been associated with campaigns following fake-update style malware chains and with malspam-driven distribution.

The family is heterogeneous, and capabilities vary by variant and operator. High-confidence behaviors include cryptocurrency mining, network propagation within Windows environments, and persistence via WMI-based mechanisms. Reporting also places CoinMiner in Linux threat telemetry and in campaigns that simultaneously targeted Windows and Android delivery infrastructure, but the strongest and most consistent association is with Windows-based cryptomining activity. CoinMiner has been prevalent in enterprise and public-sector malware reporting over multiple years, reflecting its continued utility as a low-friction monetization payload for both opportunistic and more structured threat operations.