Loading story…
Kaspersky reported that the open-source XMRig Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable RDP access, deploy Trojan-Ransom.Win32.Crusis, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers.
Telemetry showed more than 5,000 attempts in August 2020 to install XMRig or modified variants, with Prometei and Cliptomaner identified as major distributors. Prometei brute-forced MS SQL credentials, abused xp_cmdshell and CVE-2016-0099, and used a cross-platform .NET Core/Apphost loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as Realtek audio software, was written in AutoIT, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In October 2020, Kaspersky research examined how the open-source XMRig Monero miner was being bundled into broader malware campaigns, including ransominer activity and distribution by Prometei and Cliptomaner.
In September 2020, Kaspersky detected a newly identified malware family called Cliptomaner. It masqueraded as Realtek audio software, was written in AutoIT, mined cryptocurrency, and replaced copied wallet addresses with attacker-controlled ones.
Kaspersky Security Network telemetry showed more than 5,000 attempts during August 2020 to install XMRig or modified variants. The activity was linked in part to distribution by Prometei and other malware operators.
In an observed case in August 2020, attackers used a generic Trojan to install admin tools, create a new user, enable RDP, launch Trojan-Ransom.Win32.Crusis, and then start an XMRig loader to mine cryptocurrency before any ransom was paid.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Elastic Security Labs reported that the financially motivated **REF1695** operation has used counterfeit software installers since November 2023 to infect victims with remote access trojans and cryptocurrency miners. Recent activity relied on fake **ISO** files containing a .NET Reactor-protected loader and a text file that led to deployment of a previously undocumented **.NET implant** called **CNB Bot**, which can inject additional payloads. The infection chain instructed users to bypass Microsoft Defender SmartScreen, then used PowerShell to add broad Microsoft Defender Antivirus exclusions, launch malware, and display a fake application error to mask the compromise. Researchers linked the same actor to campaigns delivering **PureRAT**, **PureMiner**, a custom .NET-based **XMRig** loader, and **SilentCryptoMiner**, with some payloads abusing the vulnerable signed drivers `WinRing0x64.sys` and `Winring0.sys` to tune CPU settings and improve mining performance. The operation also used watchdog functions and scheduled tasks for persistence and recovery, communicated with command-and-control servers over HTTP POST, and abused **GitHub** as a trusted platform for staged payload delivery to reduce detection. Elastic estimated the campaign generated **27.88 XMR** across four tracked wallets, worth about **$9,392**.
Jun 29, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026