GhostMiner Uses WMI Fileless Persistence to Deploy Monero Miner

Researchers reported that GhostMiner evolved into a fileless cryptocurrency-mining malware strain that abuses Windows Management Instrumentation (WMI) for persistence, payload execution, and evasion on Windows systems. The malware stores Base64-encoded PowerShell in a WMI class named PowerShell_Command, installs WMI event subscriptions to relaunch itself, drops a Monero miner as C:\Windows\Temp\lsass.exe, and maintains backdoor communication with command-and-control infrastructure including 118.24.63.208 and 103.105.59.68.

The campaign also aggressively removes rival cryptominers by terminating competing processes and services, deleting scheduled tasks, blocking related network traffic, and altering hosts file entries tied to families such as MyKings, PowerGhost, PCASTLE, and BULEHERO. The activity aligns with the broader MITRE ATT&CK T1546.003 technique, which documents WMI event subscription abuse as a persistence method used by multiple malware families and threat actors, underscoring how GhostMiner weaponized native Windows management features to remain resident while monopolizing infected hosts for illicit Monero mining.