MalwareExploits 2 CVEs

Monero miner

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2026-65400Authentication Bypass in macOS Screen SharingExploited in the wild

Национальный центр кибербезопасности Нидерландов (NCSC) предупредил, что злоумышленники начали эксплуатировать критическую уязвимость CVE-2026-65400 в macOS Screen Sharing. Баг позволяет обойти аутентификацию, получив доступ к Mac без пароля, и уже применяется в реальных атаках для установки майнера Monero.

via xakepxakep.ru

CVE-2019-18935Remote Code Execution in Telerik UI for ASP.NET AJAX RadAsyncUploadExploited in the wild

The CVE-2019-18935 vulnerability, with its critical 9.8 severity score, is an untrusted deserialization vulnerability within the proprietary Progress Telerik UI (for ASP.NET AJAX) library... While originally published in December 2019, the flaw continues to be exploited even today despite patches and fixes having been made available.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

4 techniques

T1078Valid AccountsEvidence2

Apple patched the macOS Screen Sharing issue on August 6, warning that it could allow attackers to bypass authentication and log into vulnerable devices without valid credentials.

T1133External Remote ServicesEvidence2

Проблема CVE-2026-65400 затрагивает встроенную в macOS функцию Screen Sharing... Для соединения в этом случае используется VNC через TCP-порт 5900.

T1190Exploit Public-Facing ApplicationEvidence2

По их данным, для атаки достаточно отправить уязвимому Mac несколько специально подготовленных пакетов.

T1195Supply Chain CompromiseEvidence1

Исследователи обнаружили, что браузер Hola для Windows был скомпрометирован в ходе атаки на цепочку поставок. В результате вместе с браузером некоторые пользователи получали скрытый исполняемый файл, который оказался майнером криптовалюты Monero.

Execution

2 techniques

T1053Scheduled Task/JobEvidence1

Persist by adding task scheduler and registry.

T1059Command and Scripting InterpreterEvidence1

These components can include a shell script or a java class that can write a file to disk or memory and executes the final payload.

Persistence

7 techniques

T1053Scheduled Task/JobEvidence1

Persist by adding task scheduler and registry.

T1078Valid AccountsEvidence2

Apple patched the macOS Screen Sharing issue on August 6, warning that it could allow attackers to bypass authentication and log into vulnerable devices without valid credentials.

T1098.004SSH Authorized KeysEvidence1

Check for the Trend Micro cryptominer indicators, unexpected outbound connections, new SSH keys or authorized_keys entries, unfamiliar persistence

T1112Modify RegistryEvidence1

Persist by adding task scheduler and registry.

T1133External Remote ServicesEvidence2

T1543.003Windows ServiceEvidence1

...создавала службу Windows hola_monitor_svc для автоматического запуска...

T1547.001Registry Run Keys / Startup FolderEvidence1

Persist by adding task scheduler and registry.

Privilege Escalation

7 techniques

T1053Scheduled Task/JobEvidence1

Persist by adding task scheduler and registry.

T1055Process InjectionEvidence1

Initiate legitimate conhost.exe and inject itself into its process.

T1068Exploitation for Privilege EscalationEvidence3

Threat actors were seen abusing it to gain root access and deploy a Monero miner.

T1078Valid AccountsEvidence2

Apple patched the macOS Screen Sharing issue on August 6, warning that it could allow attackers to bypass authentication and log into vulnerable devices without valid credentials.

T1098.004SSH Authorized KeysEvidence1

Check for the Trend Micro cryptominer indicators, unexpected outbound connections, new SSH keys or authorized_keys entries, unfamiliar persistence

T1543.003Windows ServiceEvidence1

...создавала службу Windows hola_monitor_svc для автоматического запуска...

T1547.001Registry Run Keys / Startup FolderEvidence1

Persist by adding task scheduler and registry.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

Анализ показал, что этот компонент не проходил сертификацию, не имел цифровой подписи и временных меток, содержал обфусцированный код и обладал возможностями для записи в память.

T1036MasqueradingEvidence2

Impact, cryptojacking (TA0040) Monero miner renamed and dropped to a hidden path, launched in background, staged via public file-share

T1055Process InjectionEvidence1

Initiate legitimate conhost.exe and inject itself into its process.

T1070Indicator RemovalEvidence1

Modify Hosts file for disrupting connections of security solutions.

T1078Valid AccountsEvidence2

Apple patched the macOS Screen Sharing issue on August 6, warning that it could allow attackers to bypass authentication and log into vulnerable devices without valid credentials.

T1564Hide ArtifactsEvidence1

Defense Evasion (TA0005) AI-agent approvals disabled; miner masquerade and hidden path; idle-cover keep-alives; ephemeral screen sessions

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Persist by adding task scheduler and registry.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence3

A majority of the exploit payloads seen early on after the patch was released by Apache used HTTP and LDAP protocols to fetch malicious payloads from attacker server.

Impact

1 technique

T1496Resource HijackingEvidence8

Cryptojacking The operator drops a Monero miner onto compromised hosts, renamed to an innocuous filename and relaunched from a hidden path in the background, staged through a public file-sharing service to evade notice.

Other

1 technique

T1562Impair DefensesEvidence2

По данным специалистов, малварь добавляла себя в исключения Microsoft Defender...

INDICATORS OF COMPROMISE

IOCs tracked for this family

28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

22 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app8 days ago

ip.v4●●●●●●●●●●●●View more in app8 days ago

ip.v4●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cloudsek blogNews

Aug 19, 2026

AI-Agent-Driven Offensive Operation : Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign Leading to Mass Wallet and Credential Compromise | CloudSEK

A disguised cryptomining payload deployed to compromised hosts for illicit revenue generation.

security weekNews

Aug 17, 2026

Recent macOS Screen Sharing Vulnerability Exploited in Attacks - SecurityWeek

A cryptomining payload deployed after exploitation to mine Monero on compromised macOS systems.

seqriteNews

Dec 18, 2020

Chinese cyberspies breach the Indian enterprise

Cryptomining malware noted as co-infecting some victims during the same period, but not the main focus of the report.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching28

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 2 CVEs

Monero miner

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2026-65400Authentication Bypass in macOS Screen SharingExploited in the wild

via xakepxakep.ru

CVE-2019-18935Remote Code Execution in Telerik UI for ASP.NET AJAX RadAsyncUploadExploited in the wild

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

4 techniques

T1078Valid AccountsEvidence2

Apple patched the macOS Screen Sharing issue on August 6, warning that it could allow attackers to bypass authentication and log into vulnerable devices without valid credentials.

T1133External Remote ServicesEvidence2

T1190Exploit Public-Facing ApplicationEvidence2

По их данным, для атаки достаточно отправить уязвимому Mac несколько специально подготовленных пакетов.

T1195Supply Chain CompromiseEvidence1

Execution

2 techniques

T1053Scheduled Task/JobEvidence1

Persist by adding task scheduler and registry.

T1059Command and Scripting InterpreterEvidence1

These components can include a shell script or a java class that can write a file to disk or memory and executes the final payload.

Persistence

7 techniques

T1053Scheduled Task/JobEvidence1

Persist by adding task scheduler and registry.

T1078Valid AccountsEvidence2

Apple patched the macOS Screen Sharing issue on August 6, warning that it could allow attackers to bypass authentication and log into vulnerable devices without valid credentials.

T1098.004SSH Authorized KeysEvidence1

Check for the Trend Micro cryptominer indicators, unexpected outbound connections, new SSH keys or authorized_keys entries, unfamiliar persistence

T1112Modify RegistryEvidence1

Persist by adding task scheduler and registry.

T1133External Remote ServicesEvidence2

T1543.003Windows ServiceEvidence1

...создавала службу Windows hola_monitor_svc для автоматического запуска...

T1547.001Registry Run Keys / Startup FolderEvidence1

Persist by adding task scheduler and registry.

Privilege Escalation

7 techniques

T1053Scheduled Task/JobEvidence1

Persist by adding task scheduler and registry.

T1055Process InjectionEvidence1

Initiate legitimate conhost.exe and inject itself into its process.

T1068Exploitation for Privilege EscalationEvidence3

Threat actors were seen abusing it to gain root access and deploy a Monero miner.

T1078Valid AccountsEvidence2

Apple patched the macOS Screen Sharing issue on August 6, warning that it could allow attackers to bypass authentication and log into vulnerable devices without valid credentials.

T1098.004SSH Authorized KeysEvidence1

Check for the Trend Micro cryptominer indicators, unexpected outbound connections, new SSH keys or authorized_keys entries, unfamiliar persistence

T1543.003Windows ServiceEvidence1

...создавала службу Windows hola_monitor_svc для автоматического запуска...

T1547.001Registry Run Keys / Startup FolderEvidence1

Persist by adding task scheduler and registry.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

T1036MasqueradingEvidence2

Impact, cryptojacking (TA0040) Monero miner renamed and dropped to a hidden path, launched in background, staged via public file-share

T1055Process InjectionEvidence1

Initiate legitimate conhost.exe and inject itself into its process.

T1070Indicator RemovalEvidence1

Modify Hosts file for disrupting connections of security solutions.

T1078Valid AccountsEvidence2

Apple patched the macOS Screen Sharing issue on August 6, warning that it could allow attackers to bypass authentication and log into vulnerable devices without valid credentials.

T1564Hide ArtifactsEvidence1

Defense Evasion (TA0005) AI-agent approvals disabled; miner masquerade and hidden path; idle-cover keep-alives; ephemeral screen sessions

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Persist by adding task scheduler and registry.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence3

A majority of the exploit payloads seen early on after the patch was released by Apache used HTTP and LDAP protocols to fetch malicious payloads from attacker server.

Impact

1 technique

T1496Resource HijackingEvidence8

Other

1 technique

T1562Impair DefensesEvidence2

По данным специалистов, малварь добавляла себя в исключения Microsoft Defender...

INDICATORS OF COMPROMISE

IOCs tracked for this family

28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

22 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app8 days ago

ip.v4●●●●●●●●●●●●View more in app8 days ago

ip.v4●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cloudsek blogNews

Aug 19, 2026

AI-Agent-Driven Offensive Operation : Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign Leading to Mass Wallet and Credential Compromise | CloudSEK

A disguised cryptomining payload deployed to compromised hosts for illicit revenue generation.

security weekNews

Aug 17, 2026

Recent macOS Screen Sharing Vulnerability Exploited in Attacks - SecurityWeek

A cryptomining payload deployed after exploitation to mine Monero on compromised macOS systems.

seqriteNews

Dec 18, 2020

Chinese cyberspies breach the Indian enterprise

Cryptomining malware noted as co-infecting some victims during the same period, but not the main focus of the report.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching28

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.