Loading malware…
XMRigCC is an open-source cryptocurrency miner derived from XMRig that is frequently repurposed for unauthorized Monero mining. Malicious deployments consume compromised systems' processing resources, producing elevated CPU utilization and potentially degrading service performance. Observed payloads include 32-bit and 64-bit variants, with deployments on Windows and Linux systems.
XMRigCC has been used by multiple financially motivated threat actors, including TeamTNT and the Tor2Mine operation. Targets have included internet-facing application servers, cloud instances, and containerized environments. Attackers have installed it after exploiting vulnerable Confluence servers through CVE-2023-22527 and after compromising exposed Microsoft SQL Server accounts through brute-force attacks. It has also been delivered through executable droppers and PowerShell loader chains in multi-payload campaigns involving AZORult, Remcos, DarkVNC, and clipboard cryptocurrency stealers.
Malicious installation chains establish persistence through scheduled tasks and Windows services, or through root-level services on Linux. Windows loaders associated with XMRigCC deployments have attempted to disable antivirus products, suppress security notifications, disable event logging, and terminate diagnostic and process-monitoring tools. These persistence and evasion behaviors belong to the surrounding deployment tooling rather than necessarily to the miner itself. The mining payload connects to configured mining pools to generate cryptocurrency for its operators.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This actor was exploiting CVE-2018-11776, an Apache Struts 2 namespace vulnerability. [...] This actor dropped XMRigCC as a payload.
Rapid7 identified evidence of exploitation for CVE-2023-22527 within available Confluence logs. This vulnerability is a critical OGNL injection vulnerability that abuses the text-inline.vm component of Confluence by sending a modified POST request to the server.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They appear to include 64-bit and 32-bit variants of XMRigCC — a variant of the XMRig miner.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
It then creates a scheduled task with the name OneDrive SyncTask to execute hourly and launch the miner which is read from the previously created registry entry.
It’s using Redis’s FLUSHALL issue to create a cron job that downloads a setup script... The cron job seen added in the same figure executes the upload script every five minutes.
It then creates a scheduled task with the name OneDrive SyncTask to execute hourly and launch the miner which is read from the previously created registry entry.
It’s using Redis’s FLUSHALL issue to create a cron job that downloads a setup script... The cron job seen added in the same figure executes the upload script every five minutes.
The script ensures the processes are started again if the machine is rebooted. The script adds either a System V init script or a systemd service depending on what is used by the system. | The script adds either a System V init script or a systemd service depending on what is used by the system.
It then creates a scheduled task with the name OneDrive SyncTask to execute hourly and launch the miner which is read from the previously created registry entry.
It’s using Redis’s FLUSHALL issue to create a cron job that downloads a setup script... The cron job seen added in the same figure executes the upload script every five minutes.
The script ensures the processes are started again if the machine is rebooted. The script adds either a System V init script or a systemd service depending on what is used by the system. | The script adds either a System V init script or a systemd service depending on what is used by the system.
It lets you control your miners via a Dashboard or the REST api. | XMRigCC has a "Command and Control" (CC) server part, a daemon to keep the XMRigCC miner alive and modifications to send the current status to the CC Server.
93 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cryptomining software deployed following exploitation of CVE-2023-22527 on Confluence servers. A bash script named w.sh downloaded its installation archive from 38.6.173.11 and executed the miner. The attackers created javasgs_miner.service to run as root for persistence. Investigators confirmed successful execution and increased system resource utilization.
Mentioned as the mining software base underlying Tor2Mine.
Cryptocurrency-mining tool deployed by TeamTNT in its cryptojacking operations against Redis servers and subsequently Docker environments.
Variant of XMRig mentioned as infrastructure overlap/background context rather than a primary malware focus of the report.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.