Loading story…
A wormable cryptojacking campaign has been reported distributing a custom XMRig miner through pirated “premium” software bundles. The multi-stage infection chain is designed to maximize mining hashrate—often destabilizing infected systems—and includes worm-like propagation to spread via external storage devices, enabling movement even in air-gapped environments.
Technical analysis attributes the campaign to a modular controller binary (commonly referenced as Explorer.exe) that operates as a persistent state machine, switching roles (e.g., installer, watchdog, payload manager, cleaner) based on command-line arguments. The malware uses BYOVD (Bring Your Own Vulnerable Driver) by loading a legitimate signed but vulnerable driver (reported as WinRing0x64.sys) to obtain elevated/kernel-level capabilities, and it incorporates a time-based logic bomb/kill switch that checks local system time against a hard-coded timestamp to gate behavior and support stealthy cleanup/self-destruct routines.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
On February 23, 2026, Trellix disclosed details of the cryptojacking campaign, describing its use of pirated software lures, a modular multi-stage dropper, USB worm propagation, and BYOVD-based privilege escalation. The report also highlighted watchdog components, a controller binary named Explorer.exe, and a kill-switch mechanism dubbed 'Barusu'.
The malware included a logic bomb configured to trigger on December 23, 2025, after which it would perform a controlled cleanup and decommissioning routine. Researchers said this suggested the operators intended the campaign to have a finite lifecycle.
Trellix observed a notable spike in mining activity on December 8, 2025. The increase was associated with a bespoke XMRig deployment chain designed for stealth, persistence, and improved RandomX mining performance.
Researchers observed low but rising mining-pool activity beginning in December 2025, indicating the operation was becoming more active. Trellix characterized the malware as a resilient botnet using BYOVD via the vulnerable WinRing0x64.sys driver tied to CVE-2020-14979.
Trellix reported that the custom XMRig cryptojacking operation was active on a limited basis through November 2025. The campaign used pirated software installers to deliver a multi-stage miner with persistence, privilege escalation, and worm-like USB propagation.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the open-source **XMRig** Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable **RDP** access, deploy **Trojan-Ransom.Win32.Crusis**, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers. Telemetry showed more than **5,000** attempts in August 2020 to install XMRig or modified variants, with **Prometei** and **Cliptomaner** identified as major distributors. Prometei brute-forced **MS SQL** credentials, abused `xp_cmdshell` and **`CVE-2016-0099`**, and used a cross-platform **.NET Core/Apphost** loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as **Realtek** audio software, was written in **AutoIT**, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Jun 29, 2026
Researchers reported a covert Linux cryptomining campaign that gained access through a trusted third-party connection, escalated privileges to root, and then abused Pluggable Authentication Modules (PAM) to move into low-privileged accounts without passwords. The operators reportedly used `pam_rootok` with `su`, disabled or suppressed logging, altered authentication records, and planted redundant cron-based persistence across less-monitored user accounts to preserve access and complicate remediation. Group-IB linked the activity to the **V25 Generation 26** campaign family. The payload was described as a heavily modified, self-unlinking **XMRig 6.25.0** implant that ran from memory, used `/tmp/.lock` as a mutex, and spoofed process names such as `ssh` to evade detection. Researchers said the miner optimized execution with CPU-aware worker spawning, MSR interaction, and Huge Pages, while disguising Stratum mining traffic with a fake **Java Agent** user agent string to blend into normal network activity. Published indicators included the domain `unable[.]download`, campaign identifier `My-V25-GEN-26`, and multiple malware hashes tied to the implant.
Aug 11, 2026
A financially motivated malware campaign used malvertising and fake cracked-software downloads to infect consumer and SMB victims worldwide with **Vidar Stealer** and the **XMRig** Monero miner. Researchers said the operation, active in April 2026 and aimed primarily at victims in the U.S. and European Union, relied on Go-based loaders built with **Factory-v3**, fake code-signing certificates impersonating **JustWatch** and later **Bleacher Report**, and oversized binaries padded with null bytes to hinder detection and analysis. After execution, the malware used persistence mechanisms, DLL sideloading variants, and an **AMSI** bypass before dropping Vidar and XMRig payloads. The stealer exfiltrated credentials, browser cookies, and cryptocurrency wallet data to attacker-controlled infrastructure, while the miner generated Monero and alerted operators through Telegram messages labeled **"X3D MINER • NEW LOG"**. Researchers assessed the operator as a **Vidar malware-as-a-service affiliate** and noted the same Factory-v3 service also supported a concurrent **Lumma Stealer** campaign.
Aug 11, 2026