Loading story…
Researchers reported that GhostMiner evolved into a fileless cryptocurrency-mining malware strain that abuses Windows Management Instrumentation (WMI) for persistence, payload execution, and evasion on Windows systems. The malware stores Base64-encoded PowerShell in a WMI class named PowerShell_Command, installs WMI event subscriptions to relaunch itself, drops a Monero miner as C:\Windows\Temp\lsass.exe, and maintains backdoor communication with command-and-control infrastructure including 118.24.63.208 and 103.105.59.68.
The campaign also aggressively removes rival cryptominers by terminating competing processes and services, deleting scheduled tasks, blocking related network traffic, and altering hosts file entries tied to families such as MyKings, PowerGhost, PCASTLE, and BULEHERO. The activity aligns with the broader MITRE ATT&CK T1546.003 technique, which documents WMI event subscription abuse as a persistence method used by multiple malware families and threat actors, underscoring how GhostMiner weaponized native Windows management features to remain resident while monopolizing infected hosts for illicit Monero mining.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro reported observing a GhostMiner cryptocurrency-mining malware variant on August 2. The variant used Windows Management Instrumentation event subscriptions and a custom WMI class for persistence, payload execution, and evasion on Windows systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
blog.trendmicro.com
Open sourceattack.mitre.org
Open sourceblog.minerva-labs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **GhostEngine** (also called **Hidden Shovel**), a malware framework used in intrusions tracked by Elastic as `REF4578` that disables endpoint detection and response tools before installing a persistent **XMRig** Monero miner. The infection chain begins with a masqueraded `Tiworker.exe` that launches a PowerShell loader, clears logs, disables Microsoft Defender, establishes persistence through scheduled tasks and a phantom DLL, and then abuses vulnerable Avast and IObit kernel drivers to kill and delete security agents. Elastic and Antiy both described the operation as a two-stage campaign built to silently remove defenses inside corporate environments and maintain remote access through a PowerShell backdoor. The campaign used HTTP with backup IPs and FTP with embedded credentials for command-and-control, while miner configuration pointed to `pool.supportxmr[.]com` and a specific Monero payment identifier that Elastic said was still active at publication. Defenders were urged to watch for suspicious PowerShell execution, unusual file paths, privilege escalation, vulnerable driver loading, event log clearing, and mining-related network traffic. Elastic also published a **YARA** rule for `Windows.Trojan.GhostEngine` covering file and memory detection on x86 and arm64 systems, with indicators including `C:\Windows\Fonts`, `WinRing0x64.sys`, and the `IOBitUnlocker` device string.
Aug 15, 2026
A renewed **WannaMine** outbreak is compromising Windows systems by exploiting the SMB flaws addressed in **`MS17-010`**, including the **EternalBlue** attack path that was also used by WannaCry. After achieving privileged code execution on unpatched hosts, the worm uses **PowerShell** and **WMI** to identify system architecture, fetch the correct payload, move laterally across the network, and execute its cryptomining components directly in memory. Investigators found the malware also compiles and uses **PingCastle** to locate additional vulnerable machines, deploys a PowerShell implementation of **Mimikatz** for credential theft and lateral movement, and hides components in **WMI classes** while creating **WMI event-based persistence**. It further changes power settings to keep systems active for mining and terminates competing miners on common mining ports, underscoring that organizations remain exposed largely because systems vulnerable to the long-patched **`MS17-010`** flaws are still present in enterprise environments.
Aug 15, 2026
Researchers identified a multi-stage, fileless-leaning Windows malware chain that stores PowerShell payloads in the Registry and hides later stages in DNS TXT records, PNG images, ZIP archives, and WAV files. The malware reconstructs .NET assemblies and loads an **XMRig** cryptocurrency miner directly into memory, configured for RandomX mining with up to 40 CPU threads and a TLS-connected mining pool. The infection establishes persistence through hidden scheduled tasks and a permanent WMI event subscription, while attempting to weaken Microsoft Defender controls and erase PowerShell history. It uses DNS-over-HTTPS via Google DNS alongside HTTP/HTTPS communications for command-and-control and host identification; researchers warned that this active C2 channel could also deliver commands or payloads beyond cryptomining.
Sep 20, 2026