Loading malware…
XMRig is legitimate, open-source cryptocurrency-mining software widely abused in cryptojacking operations to mine Monero using compromised computing resources. Malicious deployments are documented on Windows, Linux, and macOS, including enterprise endpoints, servers, and containerized workloads. Unauthorized mining consumes processing capacity and electricity and can degrade application performance and service availability.
Attackers deploy XMRig after exploiting internet-facing applications, exposed or misconfigured infrastructure, and remote-access vulnerabilities. Documented entry points include vulnerable Ruby on Rails applications, Microsoft Exchange servers, React and Next.js deployments, AhsayCBS backup servers, and macOS Screen Sharing. XMRig has also been embedded in a compromised project's Docker image. It is used as a mining payload in campaigns involving Kinsing, PoeLLM, and ProxyShellMiner rather than being exclusive to a single threat actor.
Malicious installation chains commonly rename the miner to resemble legitimate software or system services and maintain execution through Windows services, scheduled tasks, systemd units, cron jobs, or macOS LaunchDaemons. Some loaders inject XMRig into other processes through process hollowing, while companion scripts suppress mining when monitoring tools are open. Certain Windows deployments use a vulnerable hardware-access driver to improve RandomX mining performance. These persistence, concealment, and delivery mechanisms belong to the surrounding attack tooling and are not necessarily native XMRig capabilities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
29 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The exploit combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
The exploit combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
The exploit combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
The exploit combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Our threat intelligence platform has been logging a huge spike in ruby http exploiting since yesterday (10 January) at 23:00. The exploit has been trying to leverage a fairly old CVE (CVE-2013-0156) that allows remote code execution. | “We found the coinminer used is the linux version of XMRIG Cpu Miner.” The attacker downloads the miner as sshd or sshd.i686 and launches it on compromised servers.
Станува збор за ранливостите CVE-2026-105133 и CVE-2026-105134, кои можат да се комбинираат за заобиколување на автентикацијата и извршување произволни команди на засегнатите системи.
Станува збор за ранливостите CVE-2026-105133 и CVE-2026-105134, кои можат да се комбинираат за заобиколување на автентикацијата и извршување произволни команди на засегнатите системи.
Table 1 lists Synology CVE-2017-9554 as a NAS information-leak vulnerability, with AV labels gafgyt, intercepter, minerd, mirai, stealthworker, and xmrig. | Synology CVE-2017-9554 NAS Info Leak Various gafgyt, intercepter, minerd, mirai, stealthworker, xmrig
The observations show exploitation of CVE-2026-65400, an improper-authentication weakness being used against a limited number of macOS systems. | The final payload is XMRig 6.26.0, software capable of mining the Monero cryptocurrency. The attackers copy it, rename it, and apply an ad-hoc signature before hiding it under a system-like path.
Next.js released a security advisory for CVE-2025-66478, rated CVSS 10.0, because it uses the affected React packages. The report identifies affected Next.js versions and documents reconnaissance and remote command execution against a vulnerable Next.js application. | The first file downloads the xmrig binary from github, checks if root privileges (uid 0) are present for the current user, and sets up a systemd unit with the name system-update-service.
React patched CVE-2025-55182 on December 3: "a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints". The report documents malicious scanning and compromised servers receiving cryptominers. | The first file downloads the xmrig binary from github, checks if root privileges (uid 0) are present for the current user, and sets up a systemd unit with the name system-update-service.
CVE-2020-5902 appears in the list of vulnerabilities most frequently exploited by Kinsing.
Investigators identified requests attempting to exploit CVE-2017-9841 in PHPUnit. The report also explicitly identifies this vulnerability as a target of Kinsing's automated scanning and exploitation.
CVE-2021-26084 appears in the list of vulnerabilities most frequently exploited by Kinsing.
CVE-2019-17564 appears in the list of vulnerabilities most frequently exploited by Kinsing.
CVE-2021-44228 is listed among vulnerabilities frequently exploited by Kinsing. The report identifies Apache Log4j as a target and describes lh.sh as a specialized script for Log4Shell.
CVE-2020-10684 appears in the list of vulnerabilities most frequently exploited by Kinsing.
CVE-2023-35042 appears in the list of vulnerabilities most frequently exploited by Kinsing.
CVE-2022-26134 appears in the list of vulnerabilities most frequently exploited by Kinsing.
CVE-2022-24706 appears in the list of vulnerabilities most frequently exploited by Kinsing.
CVE-2020-9480 appears in the list of vulnerabilities most frequently exploited by Kinsing.
CVE-2019-19781 appears in the list of vulnerabilities most frequently exploited by Kinsing.
CVE-2020-17519 appears in the list of vulnerabilities most frequently exploited by Kinsing.
CVE-2021-41773 appears in the list of vulnerabilities most frequently exploited by Kinsing.
For LiteLLM, a crafted POST to the connection endpoint “was likely the exploitation path,” based on a flaw where two endpoints would run a supplied command on the host with no role check (CVE-2026-42271), which CISA added to its list of exploited vulnerabilities in June.
2024년 5월 HFS의 원격 코드 실행 취약점인 CVE-2024-23692가 공개되었으며 이를 활용할 경우 공격자는 HFS에 명령이 포함된 패킷을 전송하여 HFS가 악성 명령을 실행하도록 할 수 있다.
GeoServer의 원격 코드 실행 취약점(CVE-2024-36401)이 공개된 이후 최근까지도 해당 취약점을 악용해 악성코드를 설치하는 사례들이 확인되고 있다.
최근 국내 취약한 ActiveMQ 서버를 대상으로 CVE-2023-46604 취약점 공격을 통해 악성코드를 유포하는 사례가 확인되었다.
Malicious activity exploiting the recently disclosed Oracle WebLogic critical deserialization vulnerability (CVE-2019-2725) is surging. Payloads include Sodinokibi, Muhstik, XMRig, and GandCrab.
52 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
«На этом этапе используются серверы загрузки, с которых на компрометированные хосты доставляются основные компоненты вредоносного ПО: ... бинарный файл kinsing, майнер XMRig и руткит».
Resource hijacking and deploying XMRig Docker images to mine cryptocurrency.
Notably, this XMRig miner is also deployed by the Lcrypt0rx ransomware variant.
The use of variants of the open-source miner XMRig intended for botnet mining, with versions dependent on the victim's architecture.
If the vulnerability attack succeeds, the group ultimately installs Monero CoinMiner (XMRig).
가장 많이 사용된 악성코드는 모네로 가상 화폐를 채굴하는 XMRig이며 적어도 4개의 공격자들이 HFS를 공격하여 코인 마이너를 설치하고 있다.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
It deletes all cron jobs, and adds a new one that runs every five minutes to check for command-and-control (C&C) server connectivity.
Création d’une tâche planifiée nommée XMRig-[nom_machine] lançant system.exe avec les privilèges SYSTEM à chaque démarrage Windows.
Le script PowerShell se fait passer pour un utilitaire d’optimisation Windows nommé “msf utility \ PC Opt”.
The attacker downloaded the shell file and ran it with bash from memory.
It deletes all cron jobs, and adds a new one that runs every five minutes to check for command-and-control (C&C) server connectivity.
It deletes all cron jobs, and adds a new one that runs every five minutes to check for command-and-control (C&C) server connectivity.
The threat actor is using 2 Processhider rootkits to hide the cryptominer (tmp) and all SH commands.
Ces fonctions sont factices et n’effectuent aucune action réelle, affichant uniquement de faux messages de progression avec des pauses aléatoires.
Named the service MicrosoftEdgeUpdateSvc to look like the legitimate Edge Update service (edgeupdate).
Renamed the NSSM utility to msedge.exe and the XMR miner to edge.exe.
The attacker removes all their traces by clearing log and bash history.
T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)
Téléchargement du payload XMRig depuis https://msfconfig[.]icu:443/tmp/system.txt vers un fichier temporaire aléatoire
1,516 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cryptocurrency-mining software deployed through exploitation of an exposed Plex Media Server honeypot. The report documents its malicious deployment but does not identify the attackers or establish the number of compromised production servers.
Cryptocurrency-mining software deployed by attackers on exposed AhsayCBS systems. Attackers chained an authentication bypass and arbitrary command execution to obtain unauthenticated remote code execution and install mining payloads and web shells.
Used for cryptocurrency mining on compromised AhsayCBS servers. The observed payload masqueraded as Microsoft Edge using the filename edge.exe in a temporary directory. The campaign included connections to xmr.kryptex[.]network on port 8029.
Legitimate open-source mining software explicitly described as abused in the campaign. Connections to associated mining infrastructure indicated active cryptomining on compromised systems; on one device, mining occurred before and during communication with the suspected DGA C2 endpoint. The report describes network evidence rather than confirmed recovery of an XMRig executable.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.