Loading story…
Researchers reported that the long-running Tofsee botnet, historically known as a modular spambot, was being distributed through the PrivateLoader malware loader tied to the ruzki pay-per-install service. While earlier reporting highlighted Tofsee’s aggressive spam activity, newer observations showed the botnet using infected systems primarily for web traffic proxying and cryptocurrency mining, with only a smaller share of activity linked to spam operations.
Analysis of Tofsee’s downloaded components identified active proxy and miner plugins, including HTTP(S) and SOCKS backconnect traffic and some spam-related POST requests routed through likely compromised websites. The mining module was configured to mine Masari (MSR) through fastpool.xyz, and researchers estimated the botnet had generated about 200,000 MSR. Sampled telemetry indicated a global infection footprint, with India accounting for roughly 33% of observed infections in the dataset.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Bitsight's sampled telemetry indicated Tofsee infections were distributed worldwide in March 2023, with India accounting for about 33% of observed infections.
Bitsight observed Tofsee being distributed in January 2023 by the PrivateLoader malware loader, which it linked to the ruzki pay-per-install service.
Bitsight found Google references to the Masari miner wallet address used by Tofsee dating back to June 2022, indicating mining-related infrastructure was in use by then.
Bitsight described Tofsee, also known as Gheg, as a long-running modular spambot that has been active since at least 2008.
Bitsight released indicators of compromise, a YARA rule, a Python string decryption example, and Suricata rules for detecting Tofsee malware and its command-and-control traffic.
Through analysis of the active miner plugin and its configured wallet, Bitsight estimated the botnet had mined about 200,000 Masari, worth roughly $1,500 at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 104 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
bitsight.com
Open sourceblog.talosintelligence.com
Open sourcevirusbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Phorpiex** botnet is being used to run large-scale sextortion spam operations while also delivering additional malware and monetizing infected systems. Point Wild traced a multi-stage infection chain that downloaded payloads from `178.16.54.109`, profiled victims through `ip-api.com` geolocation lookups, and skipped execution in countries including the US, UK, Canada, and Germany. The final payload was identified as the **Phorpiex Twizt downloader**, which established persistence and connected victims to botnet command-and-control infrastructure. Analysis from Point Wild and Bitsight shows the botnet supports multiple criminal revenue streams beyond spam. Infected hosts were observed making high volumes of outbound SMTP connections consistent with mass mailing and abuse of internal mail relays to evade blacklist-based filtering, while sextortion emails falsely claimed webcam compromise and demanded **$1,200 in Bitcoin**. Researchers also found Phorpiex capable of **clipboard hijacking**, **TCP flooding**, ransomware-related activity tied to **Twizt**, and downloading **XMRig** to mine Monero, underscoring the botnet's role as a flexible platform for spam, malware distribution, and follow-on attacks.
Jul 14, 2026
Cryptocurrency-mining malware continued to expand across enterprise and consumer environments through multiple delivery channels, including social media, malicious advertising, and compromised IoT devices. Trend Micro reported that **Digmine** spread through Facebook Messenger by posing as a video file, then abusing active Chrome-based Facebook sessions to message additional victims and install a modified `XMRig` Monero miner. Separately, a malvertising campaign abused **Google DoubleClick** to serve hidden **Coinhive** and private web miners on legitimate high-traffic sites, driving a sharp rise in detections while consuming as much as 80% of affected systems’ CPU resources. Researchers also observed an updated **Bashlite** variant targeting IoT devices, particularly systems exposing the **WeMo UPnP API**, adding cryptocurrency-mining, backdoor, DDoS, and device-bricking functions to its botnet activity. The broader threat reflects a long-running pattern in which attackers exploit known vulnerabilities, weak configurations, and trusted platforms to hijack computing resources across desktops, servers, Linux hosts, mobile devices, and IoT systems for illicit mining, while also creating opportunities for persistence, further compromise, and operational disruption.
Aug 21, 2026
A Linux-focused botnet used the Tor network and a large proxy infrastructure to conceal command-and-control traffic, deliver payloads, and exfiltrate victim data while deploying the **XMRig** Monero miner on compromised systems. The malware arrived as a multilayer-encoded shell script, supported multiple Linux architectures, and fetched legitimate utilities such as `ss`, `ps`, and `curl` when they were not already present, indicating an effort to operate flexibly across diverse server environments. The campaign also abused infrastructure-as-code and cloud management tools including **Ansible**, **Chef**, and **SaltStack** to expand laterally and scale infections. Once active, the malware removed rival cryptominers and disabled or uninstalled cloud monitoring and security agents tied to **Tencent Cloud**, **Alibaba Cloud**, and **Aegis/YunJing**, while researchers found evidence suggesting some Tor proxy and mining-pool servers used in the operation may themselves have been compromised hosts with exposed and vulnerable services.
Aug 14, 2026