XMRig Miner Embedded in Ransomware and SQL Server Intrusion Campaigns

Kaspersky reported that the open-source XMRig Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable RDP access, deploy Trojan-Ransom.Win32.Crusis, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers.

Telemetry showed more than 5,000 attempts in August 2020 to install XMRig or modified variants, with Prometei and Cliptomaner identified as major distributors. Prometei brute-forced MS SQL credentials, abused xp_cmdshell and CVE-2016-0099, and used a cross-platform .NET Core/Apphost loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as Realtek audio software, was written in AutoIT, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.