Malware

Taskgmr.ps1

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1608.001Upload MalwareEvidence1

Staged Taskgmr.ps1, edge.exe, msedge.exe, config.json and WinRing0x64.sys on Alibaba Cloud Object Storage.

Execution

1 technique

T1059.001PowerShellEvidence1

Ran Taskgmr.ps1; used PowerShell to modify config.json in the Temp folder.

Stealth

1 technique

T1564Hide ArtifactsEvidence1

If Task Manager is opened it stops MicrosoftEdgeUpdateSvc to hide the cryptomining activity. When the Task Manager is closed, it restarts it again.

Discovery

2 techniques

T1057Process DiscoveryEvidence1

Taskgmr.ps1 continuously checked whether Task Manager was running.

T1124System Time DiscoveryEvidence1

Taskgmr.ps1 used Get-Date (local host time) to decide when to kill Task Manager.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

Retrieved payloads over HTTP from Alibaba Cloud OSS.

T1105Ingress Tool TransferEvidence1

Downloaded payloads to %TEMP% with curl and certutil.exe, including the vulnerable WinRing0x64.sys driver.

Impact

1 technique

T1496.001Compute HijackingEvidence1

Deployed an XMR miner (edge.exe) and loaded the WinRing0x64.sys driver to give the miner kernel-level hardware access.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

itsecurityguruNews

Oct 9, 2026

Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners - IT Security Guru

Concealed XMRig activity by stopping the fake Edge service when Task Manager opened. It also terminated Task Manager at 18:00 local time and when Task Manager remained open for more than an hour overnight. Huntress suggested the script appeared AI-assisted based on its comments, but the content does not establish this conclusively.

huntress blogNews

Oct 8, 2026

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | Huntress

Malicious PowerShell script supporting the cryptomining operation. It continuously monitors Task Manager, stops the mining service while Task Manager is open, and restarts the service when it closes. It also terminates Task Manager at 18:00 local time or after prolonged overnight use.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Taskgmr.ps1

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1608.001Upload MalwareEvidence1

Staged Taskgmr.ps1, edge.exe, msedge.exe, config.json and WinRing0x64.sys on Alibaba Cloud Object Storage.

Execution

1 technique

T1059.001PowerShellEvidence1

Ran Taskgmr.ps1; used PowerShell to modify config.json in the Temp folder.

Stealth

1 technique

T1564Hide ArtifactsEvidence1

If Task Manager is opened it stops MicrosoftEdgeUpdateSvc to hide the cryptomining activity. When the Task Manager is closed, it restarts it again.

Discovery

2 techniques

T1057Process DiscoveryEvidence1

Taskgmr.ps1 continuously checked whether Task Manager was running.

T1124System Time DiscoveryEvidence1

Taskgmr.ps1 used Get-Date (local host time) to decide when to kill Task Manager.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

Retrieved payloads over HTTP from Alibaba Cloud OSS.

T1105Ingress Tool TransferEvidence1

Downloaded payloads to %TEMP% with curl and certutil.exe, including the vulnerable WinRing0x64.sys driver.

Impact

1 technique

T1496.001Compute HijackingEvidence1

Deployed an XMR miner (edge.exe) and loaded the WinRing0x64.sys driver to give the miner kernel-level hardware access.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

itsecurityguruNews

Oct 9, 2026

Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners - IT Security Guru

huntress blogNews

Oct 8, 2026

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | Huntress

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.