Loading story…
Trellix published a technical deep dive on a Monero mining campaign, outlining how the operation deploys cryptomining malware to hijack victim compute resources for illicit cryptocurrency generation. The report indicates the campaign is centered on monetizing compromised systems through Monero (XMR) mining, a tactic commonly favored by threat actors because the currency’s privacy features make financial tracking more difficult.
The analysis focuses on the campaign’s technical behavior and infection workflow, providing defenders with details intended to support detection and response. Trellix’s write-up frames the activity as an active cryptojacking threat in which attackers prioritize persistence and resource abuse over disruptive encryption or data theft, underscoring the need for organizations to monitor for unauthorized mining processes, abnormal CPU utilization, and related malware artifacts across affected environments.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Trellix published a research blog post titled "Technical Deep Dive: The Monero Mining Campaign," indicating public disclosure of technical details about the campaign. No additional incident dates or discrete prior events are provided in the reference content.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
A cryptocurrency-mining malware campaign deployed an **XMRig-based Monero miner** through a dropper that appeared benign unless it was launched with a specific set of command-line arguments. Once triggered, the malware used **process hollowing**, code injection, and a suspended child process to load the miner while keeping the dropped file itself looking non-malicious, frustrating static inspection, sandboxing, and manual analysis. The activity increased in early November, with the highest volume of infection attempts observed on November 20 across Kuwait, Thailand, India, Bangladesh, the United Arab Emirates, Brazil, and Pakistan. The tradecraft aligns with ATT&CK techniques for stealth and evasive communications, including the broader use of **non-standard ports** and protocol mismatches by malware operators to conceal command-and-control or related traffic inside commonly permitted network flows.
Aug 15, 2026
Researchers detailed Linux-focused cryptojacking operations that compromise internet-exposed systems through **SSH brute-force attacks** and then deploy **XMRig** to mine Monero. One campaign, tracked as **Krane**, was first observed through honeypot activity and used Bash scripts, Python tooling, and ELF binaries to establish persistence, erase and recreate logs, kill rival miners and botnets, and move laterally across additional hosts. Krane operators also used subnet and SYN scanning, SSH banner grabbing, and credential attacks to identify new victims, while infected systems reported discovered targets back to command-and-control infrastructure every 15 seconds. The reporting aligns with broader findings on long-running Linux cryptojacking activity, including the **WatchDog** campaign, which similarly maintained large-scale miner deployments over an extended period. In Krane, analysts linked delivery infrastructure to multiple download servers and network space associated with **AS53667/PONYNET**, observed package variants including `krax` and `ssh`, and tied mining activity to **Hashvault** pools and three Monero wallets. At one point, researchers saw more than 200 active miners and estimated proceeds of roughly **2434.26 EUR**, underscoring how opportunistic SSH compromise and aggressive competitor removal can sustain profitable, persistent cryptomining operations.
Aug 15, 2026