Loading story…
ESET disclosed KryptoCibule, a previously undocumented malware family active since at least late 2018 that primarily targeted users in Czechia and Slovakia through malicious torrents posing as cracked software installers. The malware combined several cryptocurrency-focused functions: it mined coins on infected systems, monitored the clipboard to replace copied wallet addresses and redirect payments, searched for cryptocurrency wallets and related files for exfiltration, and also exposed remote-access trojan (RAT) capabilities.
The campaign relied heavily on Tor and BitTorrent infrastructure and either bundled or fetched legitimate tools including Tor, Transmission, Apache httpd, and Buru SFTP Server to support command-and-control and data theft through onion services hosted on compromised machines. ESET said KryptoCibule used layered evasion and persistence measures, including obfuscation, masquerading as Adobe Reader components, scheduled tasks, Windows Defender exclusions, firewall rule changes, and checks for analysis tools and antivirus products; although only hundreds of victims were observed, the malware remained active and continued to gain new capabilities.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
ESET reported that the previously undocumented KryptoCibule malware family has been traceable back to December 2018. The malware was distributed via malicious torrents masquerading as cracked software installers and targeted cryptocurrency users.
ESET publicly documented a previously undescribed malware family named KryptoCibule, describing its cryptomining, clipboard hijacking, cryptocurrency file theft, and RAT capabilities. The report also detailed its use of Tor, BitTorrent, persistence, and defense-evasion techniques.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A refreshed **CryptBot** campaign has been distributing a Windows infostealer through websites posing as sources for cracked software, key generators, and free game or professional software downloads. The malware steals browser credentials, cookies, browsing history, cryptocurrency wallet data, credit card information, and files from infected systems, while operators use **SEO poisoning** and rapidly rotated lure sites and command-and-control infrastructure to drive victims to malicious downloads. Reporting indicates the malware was heavily associated with users seeking pirated software, and telemetry in one analyzed campaign suggested Russia was a primary target. Technical analysis of a newer CryptBot downloader shows a 32-bit statically linked sample using **libcurl `8.10.1`** and **OpenSSL `3.3.2`**, with evolving obfuscation that includes modified plaintext C2 URLs and control-flow tricks in the main routine. The downloader fetched an encrypted second-stage DLL over unencrypted HTTP from `.top` domains, then decrypted it with **AES-CBC** using a **PBKDF2-SHA1**-derived key built from the server-provided filename, the URL, and a static key suffix embedded in the sample. Researchers also noted the malware had been streamlined by removing some older anti-analysis and collection features while improving Chrome data theft so it could extract information across all Chrome versions rather than a limited version range.
Aug 15, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026