Loading story…
An attacker breached a Windows honeypot over RDP from two source IPs and installed a Monero cryptominer built around XMRig, disguising payloads as SQL-related files such as sqlserver.exe, sqlsupdater.exe, and sqlsupdater.sfx.exe. The intrusion established persistence through scheduled tasks, Windows services created with NSSM, and a Neshta-style registry hijack of the exefile open command, while built-in tools such as icacls and attrib were used to hide files and restrict access to directories to complicate detection and cleanup. The actor also redirected known mining-pool domains to localhost to suppress competing miners, and the observed wallet had received roughly 1.32 XMR at the time of reporting.
The activity aligns with Windows behaviors commonly tracked by endpoint detections for excessive service-stop attempts and repeated use of net.exe, net1.exe, or sc.exe, which can indicate efforts to disable services, evade security controls, or manipulate accounts during miner deployment. Splunk has since replaced older analytics covering those patterns with updated Windows-focused detections, underscoring that bursts of service tampering and abnormal net utility usage remain relevant signals for identifying cryptomining intrusions and related post-compromise actions on Windows hosts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Splunk removed the deprecated 'Excessive Usage Of Net App' detection from its Threat Research content library, stating it was renamed and updated. The replacement analytic was listed as 'Windows Excessive Usage Of Net App.'
Splunk removed the deprecated 'Excessive Service Stop Attempt' detection from its Threat Research content library in version 5.2.0, stating it had been renamed and its logic updated. Splunk identified the replacement as 'Windows Excessive Service Stop Attempt.'
The DFIR Report disclosed technical details of the intrusion, including payload names, persistence mechanisms, mining pool domains, file hashes, and the observation that the wallet had received about 1.32 XMR. The report characterized the activity as a Monero cryptomining operation using XMRig.
A threat actor accessed a Windows honeypot over RDP from two source IP addresses and installed an XMRig-based Monero cryptominer masquerading as SQL-related components. The intrusion also established persistence through scheduled tasks, an NSSM-managed service, and a Neshta-style registry hijack.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourcethedfirreport.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the open-source **XMRig** Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable **RDP** access, deploy **Trojan-Ransom.Win32.Crusis**, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers. Telemetry showed more than **5,000** attempts in August 2020 to install XMRig or modified variants, with **Prometei** and **Cliptomaner** identified as major distributors. Prometei brute-forced **MS SQL** credentials, abused `xp_cmdshell` and **`CVE-2016-0099`**, and used a cross-platform **.NET Core/Apphost** loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as **Realtek** audio software, was written in **AutoIT**, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Jun 29, 2026
A threat actor exploited an **SQL injection** flaw in a web page at a technology-sector organization, compromising an endpoint running **IIS** and **Microsoft SQL Server** and then carrying out extensive post-exploitation activity. Huntress reported the attacker used **base64-encoded PowerShell** for payload delivery, ran reconnaissance including `tasklist /svc`, and exfiltrated process information to an **OAST** domain. The actor then enabled **Remote Desktop Services**, created a new local administrator account named `adminweb2$`, and attempted to disable **Windows Defender** to retain access and reduce detection. The intrusion escalated into broad persistence and monetization efforts on the same host. The attacker installed known **BadIIS** modules using `appcmd.exe`, downloaded the **XMRig** cryptocurrency miner, hid miner-related files with `attrib.exe`, and used `nssm.exe` to keep the miner running persistently. Additional payloads included PowerShell and batch files such as `qdcjoke1.2.ps1`, `c_joke1.2.ps1`, and `qd_tjoke.bat`, along with **CnCrypt Protect**, likely for defense evasion. Huntress said the case stood out for the volume of system changes made after the initial compromise and warned that remediation must address the original SQL injection weakness to prevent re-entry.
Jul 13, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026