Loading story…
Attackers built a cryptojacking botnet by exploiting CVE-2017-7269, a WebDAV buffer overflow in unpatched Microsoft IIS 6.0 servers running on Windows Server 2003. The campaign, active since at least May 2017, used internet-wide scanning from Amazon Web Services-hosted IP addresses to find vulnerable systems and then delivered shellcode that downloaded and executed a minimally modified version of the open-source xmrig miner.
The compromised servers were used to mine Monero, with the operation reportedly growing to several hundred machines and generating more than 420 XMR, worth over $63,000 at the time. ESET said it detected the miner as Win32/CoinMiner.AMW and the exploit traffic as webDAV/ExplodingCan, and urged administrators to apply Microsoft patch KB3197835 and other critical updates to protect exposed legacy servers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
In late August 2017, the combined victim hash rate peaked near 160 kH/s. By the end of August, infected machines were generating about XMR5.5 per day.
Microsoft did not release a patch for CVE-2017-7269 until June 2017, when it issued KB3197835 for affected Windows Server 2003 systems. The patch addressed the exploited IIS 6.0 WebDAV vulnerability.
A malicious Monero miner based on xmrig was first seen in the wild on 2017-05-26. The malware was used to turn compromised IIS servers into cryptomining nodes.
From at least May 2017 and over roughly three months, attackers exploited unpatched IIS 6.0 servers to build a botnet of several hundred machines for Monero mining. The campaign used internet-wide scanning, including AWS-hosted infrastructure, and earned more than XMR420.
The first observed real-world exploitation of CVE-2017-7269 occurred on 2017-03-26, two days after publication according to the source. Attackers used crafted WebDAV requests to trigger the flaw.
The IIS 6.0 WebDAV buffer overflow tracked as CVE-2017-7269 was discovered in March 2017 by Zhiniang Peng and Chen Wu. The flaw affected Windows Server 2003 R2 systems running IIS 6.0.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Researchers reported that large-scale botnets continued to spread by abusing known, wormable vulnerabilities and weakly defended internet-facing systems. Proofpoint detailed the **Smominru** operation, a Monero cryptomining botnet that infected more than **526,000 Windows hosts**—likely many of them servers—primarily through the `EternalBlue` SMB flaw (`CVE-2017-0144`), with indications of additional use of `EsteemAudit` (`CVE-2017-0176`) and attacks via SQL Server. The operators were estimated to have mined about **8,900 Monero**, worth roughly **$2.8 million to $3.6 million** at the time, while using Windows Management Instrumentation in an unusual way to support propagation and mining. Separate research highlighted a **Mirai** spreader that introduced additional risk by expanding the malware’s ability to compromise vulnerable devices and propagate further across exposed environments. Together, the reports show threat actors repeatedly monetizing unpatched infrastructure through self-spreading malware, while adapting quickly when defenders disrupt infrastructure, block wallets, or sinkhole command-and-control resources. The activity underscored the operational and financial impact on organizations, including degraded server performance, increased energy costs, and continued exposure from legacy vulnerabilities that remained widely exploitable.
Aug 15, 2026
Researchers detailed Linux-focused cryptojacking operations that compromise internet-exposed systems through **SSH brute-force attacks** and then deploy **XMRig** to mine Monero. One campaign, tracked as **Krane**, was first observed through honeypot activity and used Bash scripts, Python tooling, and ELF binaries to establish persistence, erase and recreate logs, kill rival miners and botnets, and move laterally across additional hosts. Krane operators also used subnet and SYN scanning, SSH banner grabbing, and credential attacks to identify new victims, while infected systems reported discovered targets back to command-and-control infrastructure every 15 seconds. The reporting aligns with broader findings on long-running Linux cryptojacking activity, including the **WatchDog** campaign, which similarly maintained large-scale miner deployments over an extended period. In Krane, analysts linked delivery infrastructure to multiple download servers and network space associated with **AS53667/PONYNET**, observed package variants including `krax` and `ssh`, and tied mining activity to **Hashvault** pools and three Monero wallets. At one point, researchers saw more than 200 active miners and estimated proceeds of roughly **2434.26 EUR**, underscoring how opportunistic SSH compromise and aggressive competitor removal can sustain profitable, persistent cryptomining operations.
Aug 15, 2026