Loading story…
Cryptocurrency-mining malware continued to expand across enterprise and consumer environments through multiple delivery channels, including social media, malicious advertising, and compromised IoT devices. Trend Micro reported that Digmine spread through Facebook Messenger by posing as a video file, then abusing active Chrome-based Facebook sessions to message additional victims and install a modified XMRig Monero miner. Separately, a malvertising campaign abused Google DoubleClick to serve hidden Coinhive and private web miners on legitimate high-traffic sites, driving a sharp rise in detections while consuming as much as 80% of affected systems’ CPU resources.
Researchers also observed an updated Bashlite variant targeting IoT devices, particularly systems exposing the WeMo UPnP API, adding cryptocurrency-mining, backdoor, DDoS, and device-bricking functions to its botnet activity. The broader threat reflects a long-running pattern in which attackers exploit known vulnerabilities, weak configurations, and trusted platforms to hijack computing resources across desktops, servers, Linux hosts, mobile devices, and IoT systems for illicit mining, while also creating opportunities for persistence, further compromise, and operational disruption.
Pull IOCs and campaign context straight into your stack.
16 events from the most recent confirmed update back to the earliest known activity.
On January 24, 2018, Trend Micro observed a malvertising campaign abusing Google DoubleClick that caused an almost 285% increase in Coinhive web miner detections. The ads ran on legitimate high-traffic websites and covertly consumed about 80% of victims’ CPU resources using Coinhive or a private miner.
Trend Micro began seeing increased traffic to five malicious domains on January 18, 2018, and analysis showed the traffic originated from advertisements distributed through Google DoubleClick.
From January 1 to June 24, 2017, Trend Micro sensors detected 4,894 bitcoin miners that triggered more than 460,259 bitcoin-mining activities, with over 20% also associated with web- and network-based attacks.
A Mirai variant that included bitcoin-mining capabilities appeared in April 2017, showing mining functionality being added to IoT malware.
One of the U.S. Federal Reserve’s servers was misused to mine bitcoins in early February 2017.
Belkin said the WeMo vulnerability targeted by the later Bashlite activity had been detected and remediated for affected devices in 2015.
Bashlite became widely known in 2014 for large-scale distributed-denial-of-service attacks before later variants added mining and other capabilities.
Kagecoin appeared in 2014 as an Android cryptocurrency-mining threat capable of mining bitcoin, litecoin, and dogecoin.
The U.S. National Science Foundation experienced a similar supercomputer cryptocurrency-mining misuse incident in 2014.
Harvard’s Odyssey supercomputer cluster was illicitly used to mine dogecoins in 2014, illustrating misuse of institutional computing resources for cryptocurrency mining.
In January 2014, a vulnerability in Yahoo!'s Java-based advertising network was abused to expose European users to malvertisements that delivered bitcoin-mining malware.
The reference states that hacking tools and backdoors related to illicit bitcoin mining had existed since at least 2011, marking an early stage in cryptocurrency-mining abuse.
Trend Micro reported its findings about the abuse of Google DoubleClick for cryptocurrency-mining malvertising to Google.
After being notified of the findings, Facebook removed many Digmine-related links from its platform to disrupt the malware's Messenger-based propagation.
Researchers first observed the Digmine cryptocurrency-mining bot in South Korea before it spread to other countries. The malware propagated through Facebook Messenger by masquerading as a video file and ultimately deployed a modified XMRig-based Monero miner.
Trend Micro observed the updated Bashlite variant in the wild on March 21, with detections in Taiwan, the United States, Thailand, Malaysia, Japan, and Canada. The variant abused a Metasploit RCE module against devices exposing the WeMo UPnP API and added mining, backdoor, bricking, and expanded DDoS commands.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcetrendaisecurity.com
Open sourcetrendaisecurity.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026
Researchers detailed two separate cryptomining botnets targeting large numbers of devices with stealth and persistence features. Palo Alto Networks Unit 42 reported that **Eleethub** used a malicious Perl shell script to infect Unix-like systems, connect them to IRC-based command-and-control servers, and deploy rootkit components including `libprocesshider.so` and a modified `ps` binary to hide mining activity. The malware mined cryptocurrency with **XMRig** and **emech**, and also included capabilities for **UDP/TCP floods, HTTP attacks, and port scanning**, indicating the operators were building a broader botnet that could support disruptive attacks beyond mining. ESET separately uncovered and helped disrupt **VictoryGate**, a Monero-mining botnet active since at least 2019 that infected at least **35,000 devices**, with more than **90%** of victims located in **Peru** and broader concentration in Latin America. VictoryGate spread mainly through **removable USB drives**, used **AutoIt-based droppers**, process injection, and **No-IP** dynamic DNS subdomains for command and control, and typically monetized infections through **XMRig** mining. After ESET reported the malicious No-IP subdomains, the provider took them down, cutting off the botnet’s ability to issue new commands or fetch additional payloads, although already infected hosts could continue mining.
Aug 15, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026