Loading story…
A cryptocurrency-mining malware campaign deployed an XMRig-based Monero miner through a dropper that appeared benign unless it was launched with a specific set of command-line arguments. Once triggered, the malware used process hollowing, code injection, and a suspended child process to load the miner while keeping the dropped file itself looking non-malicious, frustrating static inspection, sandboxing, and manual analysis.
The activity increased in early November, with the highest volume of infection attempts observed on November 20 across Kuwait, Thailand, India, Bangladesh, the United Arab Emirates, Brazil, and Pakistan. The tradecraft aligns with ATT&CK techniques for stealth and evasive communications, including the broader use of non-standard ports and protocol mismatches by malware operators to conceal command-and-control or related traffic inside commonly permitted network flows.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Trend Micro telemetry recorded the highest number of infection attempts on November 20. The most affected locations included Kuwait, Thailand, India, Bangladesh, the United Arab Emirates, Brazil, and Pakistan.
Trend Micro reported that activity for a Monero-mining malware campaign increased in early November. The campaign used a dropper that only became malicious when launched with specific command-line arguments and ultimately deployed an XMRig-based miner via process hollowing.
Malwarebytes published a technical analysis of an Ngay campaign cryptocurrency miner that used Heaven's Gate to switch from a 32-bit loader into 64-bit mode and hollow a suspended 64-bit notepad process with an XMRig payload. The report detailed the malware's RunPE/process hollowing workflow and its use of native 64-bit NTDLL APIs resolved after the mode switch.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
blog.trendmicro.com
Open sourcemalwarebytes.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a covert Linux cryptomining campaign that gained access through a trusted third-party connection, escalated privileges to root, and then abused Pluggable Authentication Modules (PAM) to move into low-privileged accounts without passwords. The operators reportedly used `pam_rootok` with `su`, disabled or suppressed logging, altered authentication records, and planted redundant cron-based persistence across less-monitored user accounts to preserve access and complicate remediation. Group-IB linked the activity to the **V25 Generation 26** campaign family. The payload was described as a heavily modified, self-unlinking **XMRig 6.25.0** implant that ran from memory, used `/tmp/.lock` as a mutex, and spoofed process names such as `ssh` to evade detection. Researchers said the miner optimized execution with CPU-aware worker spawning, MSR interaction, and Huge Pages, while disguising Stratum mining traffic with a fake **Java Agent** user agent string to blend into normal network activity. Published indicators included the domain `unable[.]download`, campaign identifier `My-V25-GEN-26`, and multiple malware hashes tied to the implant.
Aug 11, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
The **Stantinko** botnet, a long-running operation with roughly **500,000 compromised machines**, expanded its criminal activity by deploying a heavily modified and obfuscated version of the open-source `xmr-stak` miner to generate **Monero** on infected systems. The activity was observed from at least **August 2018** and primarily affected users in **Russia, Ukraine, Belarus, and Kazakhstan**, adding cryptomining to a botnet already known for large-scale abuse. The mining module used multiple evasion and resilience techniques to avoid detection and disruption. It retrieved mining proxy addresses from **YouTube video descriptions**, communicated with those proxies over TCP using **RC4 encryption** and **Base64 encoding**, and downloaded hashing code at runtime so core mining logic was not stored on disk. It also attempted to suppress competing miners, paused activity when running on battery power or when task-manager tools were detected, and scanned for security software using **CRC-32-hashed process names**. The abused YouTube channels used for proxy configuration were reported and removed.
Aug 14, 2026