Loading story…
Researchers detailed the Rarog cryptocurrency-mining Trojan, a malware family sold on underground forums and used by multiple threat actors to mine Monero. Analysis of roughly 2,500 unique samples found the malware communicating with 161 command-and-control servers and infecting more than 166,000 systems globally, with the largest concentrations in the Philippines, Russia, and Indonesia. Evidence linked the operation to the online handles arsenkooo135 and foxovsky, and suggested Rarog may be a rebranded version of the earlier DiscordiaMiner malware.
Rarog was built with broader botnet capabilities beyond coin mining, including persistence, USB propagation, configurable miner settings, DLL/module loading, malware download functions, DDoS support, self-updating, and self-deletion. The malware was reportedly marketed for about 6,000 rubles, but despite its wide reach, observed criminal returns were limited: the most profitable operator identified by researchers earned only about 0.58 Monero and 54 ByteCoin, worth roughly $123.68 at the time.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Kaspersky previously described a similar cryptocurrency miner called DiscordiaMiner and attributed it to the same "foxovsky" user. Unit 42 later cited code overlap and assessed that Rarog was likely an evolution or rebranding of DiscordiaMiner.
Unit 42 reported that the distribution of new Rarog samples peaked during the week of September 11, 2017, when researchers encountered 187 unique samples. This marked the highest observed weekly volume of new Rarog samples in their dataset.
Rarog was advertised for sale on Russian-speaking criminal underground sites, with a listed price of 6,000 rubles and a guest administration panel offered to prospective buyers. The report states the malware had been sold since June 2017.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the open-source **XMRig** Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable **RDP** access, deploy **Trojan-Ransom.Win32.Crusis**, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers. Telemetry showed more than **5,000** attempts in August 2020 to install XMRig or modified variants, with **Prometei** and **Cliptomaner** identified as major distributors. Prometei brute-forced **MS SQL** credentials, abused `xp_cmdshell` and **`CVE-2016-0099`**, and used a cross-platform **.NET Core/Apphost** loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as **Realtek** audio software, was written in **AutoIT**, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Jun 29, 2026
Researchers reported that the **Rakhni** malware family used a Delphi-based downloader, `Trojan-Downloader.Win32.Rakhni`, to decide whether an infected Windows system would receive ransomware or a cryptocurrency miner. The campaign was spread mainly through spam emails carrying malicious Word documents that lured users into launching an embedded executable disguised as a PDF, with victims concentrated in Russia. Before deploying a payload, the malware performed anti-analysis, anti-VM, and anti-sandbox checks, installed fake root certificates impersonating Microsoft and Adobe, and evaluated host traits such as processor count and the presence of a Bitcoin folder. On systems selected for encryption, the malware deployed a cryptor that targeted numerous file types and appended the `.neitrino` extension, then sent decryption-related data to the operators by email. On other hosts, it installed MinerGate-based miners for **Monero**, **Monero Original**, and **Dashcoin**, while disguising components as trusted files such as `svchost.exe`. The malware also attempted to disable Windows Defender, exfiltrated infection telemetry along with screenshots and process lists by email, and included a worm capability that copied itself into accessible startup folders on network shares to expand laterally.
Aug 14, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026