Loading story…
The Stantinko botnet, a long-running operation with roughly 500,000 compromised machines, expanded its criminal activity by deploying a heavily modified and obfuscated version of the open-source xmr-stak miner to generate Monero on infected systems. The activity was observed from at least August 2018 and primarily affected users in Russia, Ukraine, Belarus, and Kazakhstan, adding cryptomining to a botnet already known for large-scale abuse.
The mining module used multiple evasion and resilience techniques to avoid detection and disruption. It retrieved mining proxy addresses from YouTube video descriptions, communicated with those proxies over TCP using RC4 encryption and Base64 encoding, and downloaded hashing code at runtime so core mining logic was not stored on disk. It also attempted to suppress competing miners, paused activity when running on battery power or when task-manager tools were detected, and scanned for security software using CRC-32-hashed process names. The abused YouTube channels used for proxy configuration were reported and removed.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers analyzed a new cryptomining module used by the Stantinko botnet and documented unusual string obfuscation, source-level control-flow flattening, dead code, and do-nothing code designed to hinder reverse engineering and detection. They also described a binary-level deobfuscation method to reconstruct executable code while removing dead dispatches.
Since at least August 2018, Stantinko operators monetized infected systems by deploying a heavily modified and obfuscated xmr-stak-based module to mine Monero on compromised machines.
The Stantinko botnet had been active since at least 2012, establishing the start of the long-running criminal operation later associated with multiple monetization schemes.
YouTube channels whose video descriptions were used by the malware to distribute mining proxy configuration were reported and subsequently taken down.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 62 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cryptocurrency-mining malware campaign deployed an **XMRig-based Monero miner** through a dropper that appeared benign unless it was launched with a specific set of command-line arguments. Once triggered, the malware used **process hollowing**, code injection, and a suspended child process to load the miner while keeping the dropped file itself looking non-malicious, frustrating static inspection, sandboxing, and manual analysis. The activity increased in early November, with the highest volume of infection attempts observed on November 20 across Kuwait, Thailand, India, Bangladesh, the United Arab Emirates, Brazil, and Pakistan. The tradecraft aligns with ATT&CK techniques for stealth and evasive communications, including the broader use of **non-standard ports** and protocol mismatches by malware operators to conceal command-and-control or related traffic inside commonly permitted network flows.
Aug 15, 2026
A Linux-focused botnet used the Tor network and a large proxy infrastructure to conceal command-and-control traffic, deliver payloads, and exfiltrate victim data while deploying the **XMRig** Monero miner on compromised systems. The malware arrived as a multilayer-encoded shell script, supported multiple Linux architectures, and fetched legitimate utilities such as `ss`, `ps`, and `curl` when they were not already present, indicating an effort to operate flexibly across diverse server environments. The campaign also abused infrastructure-as-code and cloud management tools including **Ansible**, **Chef**, and **SaltStack** to expand laterally and scale infections. Once active, the malware removed rival cryptominers and disabled or uninstalled cloud monitoring and security agents tied to **Tencent Cloud**, **Alibaba Cloud**, and **Aegis/YunJing**, while researchers found evidence suggesting some Tor proxy and mining-pool servers used in the operation may themselves have been compromised hosts with exposed and vulnerable services.
Aug 14, 2026
Researchers detailed Linux-focused cryptojacking operations that compromise internet-exposed systems through **SSH brute-force attacks** and then deploy **XMRig** to mine Monero. One campaign, tracked as **Krane**, was first observed through honeypot activity and used Bash scripts, Python tooling, and ELF binaries to establish persistence, erase and recreate logs, kill rival miners and botnets, and move laterally across additional hosts. Krane operators also used subnet and SYN scanning, SSH banner grabbing, and credential attacks to identify new victims, while infected systems reported discovered targets back to command-and-control infrastructure every 15 seconds. The reporting aligns with broader findings on long-running Linux cryptojacking activity, including the **WatchDog** campaign, which similarly maintained large-scale miner deployments over an extended period. In Krane, analysts linked delivery infrastructure to multiple download servers and network space associated with **AS53667/PONYNET**, observed package variants including `krax` and `ssh`, and tied mining activity to **Hashvault** pools and three Monero wallets. At one point, researchers saw more than 200 active miners and estimated proceeds of roughly **2434.26 EUR**, underscoring how opportunistic SSH compromise and aggressive competitor removal can sustain profitable, persistent cryptomining operations.
Aug 15, 2026