Loading story…
A distributed cryptominer worm targeting Active Directory environments spread by chaining multiple post-exploitation techniques, including abuse of unconstrained Kerberos delegation on domain controllers running print services, credential theft with Mimikatz, and persistence through Windows Management Instrumentation (WMI) event subscriptions. The intrusion pattern aligns with known tradecraft for extracting Kerberos tickets and privileged credentials from compromised systems, then using those artifacts to move laterally and expand control across the domain.
Incident handling guidance tied to the worm emphasized containing infected hosts, identifying compromised domain controllers and print servers, and hunting for WMI filters, consumers, and MOF-based persistence that can relaunch miner payloads. The references also point to the need to review exposure to delegation misconfigurations, monitor for LSASS access and DCSync-style activity associated with Mimikatz, and remove malicious WMI subscriptions to stop reinfection and prevent the cryptomining operation from re-establishing itself in the forest.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The archived Mimikatz reference states that Benjamin Delpy wrote Mimikatz in 2007 as a Windows x32/x64 proof-of-concept program to study Windows credentials. The tool later evolved into a widely used credential theft and post-exploitation framework.
MITRE ATT&CK reports that during the SolarWinds compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot and launch a backdoor with rundll32.exe. This reflects WMI-based persistence in that campaign.
MITRE ATT&CK states that during Operation Ghost, APT29 used WMI event subscriptions to establish persistence for malware. This documents WMI event subscription abuse as part of that intrusion set's tradecraft.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
certego.net
Open sourcecertego.net
Open sourceattack.mitre.org
Open sourceadsecurity.org
Open sourceadsecurity.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A renewed **WannaMine** outbreak is compromising Windows systems by exploiting the SMB flaws addressed in **`MS17-010`**, including the **EternalBlue** attack path that was also used by WannaCry. After achieving privileged code execution on unpatched hosts, the worm uses **PowerShell** and **WMI** to identify system architecture, fetch the correct payload, move laterally across the network, and execute its cryptomining components directly in memory. Investigators found the malware also compiles and uses **PingCastle** to locate additional vulnerable machines, deploys a PowerShell implementation of **Mimikatz** for credential theft and lateral movement, and hides components in **WMI classes** while creating **WMI event-based persistence**. It further changes power settings to keep systems active for mining and terminates competing miners on common mining ports, underscoring that organizations remain exposed largely because systems vulnerable to the long-patched **`MS17-010`** flaws are still present in enterprise environments.
Aug 15, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
The **Kingminer** botnet has been repeatedly observed compromising publicly exposed **Microsoft SQL Server** instances by brute-forcing weak credentials on TCP port `1433`, then deploying cryptocurrency miners and follow-on tooling. Researchers linked these intrusions to opportunistic campaigns that install customized **XMRig** miners, use downloader scripts and fileless **PowerShell** execution, and in some cases deliver **Cobalt Strike** beacons for persistence and post-compromise control. Investigations also found payload staging through **GitHub**, abuse of legitimate Windows binaries including `MSBuild.exe`, `rundll32.exe`, `control.exe`, and `main.cpl`, and injection into trusted processes such as `wwanmm.dll` to reduce detection. Threat reports describe Kingminer as a moderately sophisticated criminal botnet that combines public offensive tools with custom malware components, including reflective loading, DLL side-loading, and credential theft capabilities derived from tools such as **Mimikatz**. In one investigated intrusion, `sqlservr.exe` launched an obfuscated VBScript that downloaded a standalone PowerShell binary and executed additional scripts in memory before starting a miner. The malware also checked systems for **BlueKeep**-related hotfixes `KB4499175` and `KB4500331` and disabled **RDP** on vulnerable hosts, apparently to block competing botnets from exploiting the same machines. Defenders were advised to enforce strong SQL passwords, restrict internet exposure, patch public-facing services, and improve logging and monitoring, as repeated attack attempts stopped once the underlying weakness was remediated.
Aug 14, 2026