Loading story…
Mexican authorities dismantled an illicit cryptocurrency-mining facility in the mountainous municipality of Tlaola, Puebla, seizing roughly 300 GPU-based mining systems. The site, near the Nuevo Necaxa/Presa de Necaxa hydroelectric infrastructure, contained about 80 medium-voltage terminals, an industrial transformer, and eight satellite antennas, suggesting substantial energy consumption and dedicated communications infrastructure.
The Attorney General’s Office, Mexican Navy, and Puebla public-security authorities are investigating suspected electricity theft through an unauthorized medium-voltage connection and whether mined cryptoassets laundered criminal proceeds. It is the fourth illegal mining operation found in the area since early 2025; no owners, arrests, wallets, or specific cryptocurrency have been publicly identified, and alleged links to CJNG, its La Barredora faction, or the Sinaloa Cartel remain unconfirmed by officials.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Authorities began coordinating with neighboring states to identify additional clandestine cryptocurrency-mining facilities after the Tlaola seizure. The effort follows reports that the site was the fourth such facility discovered near the northern Puebla hydroelectric dam area since early 2025.
Mexico's Attorney General's Office, Navy, and Puebla public-security authorities dismantled a clandestine cryptocurrency-mining site in Tlaola, Puebla, seizing about 300 GPU mining computers, roughly 80 medium-voltage terminals, a transformer, and eight satellite antennas. Investigators are examining suspected electricity theft and possible laundering of illicit proceeds; no owner, arrests, mined currency, or cartel link had been publicly confirmed.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
darkwebinformer.com
Open sourcexakep.ru
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that the **MrbMiner** malware was used in a cryptojacking campaign that hijacked computing resources to mine cryptocurrency, turning compromised systems into a covert revenue source. The operation focused on illicit cryptocurrency generation rather than disruptive encryption or data theft, allowing the actors to monetize access quietly while consuming victim CPU resources and degrading system performance. The reporting said the campaign also served a broader sanctions-evasion purpose, using mined cryptocurrency as a way to generate funds outside traditional financial channels. By pairing unauthorized mining with cryptocurrency’s relative opacity, the operators were able to create income streams that were harder to track and restrict, underscoring how commodity malware can support geopolitical and financially motivated objectives beyond simple cybercrime.
Jun 29, 2026
Researchers detailed two separate cryptomining botnets targeting large numbers of devices with stealth and persistence features. Palo Alto Networks Unit 42 reported that **Eleethub** used a malicious Perl shell script to infect Unix-like systems, connect them to IRC-based command-and-control servers, and deploy rootkit components including `libprocesshider.so` and a modified `ps` binary to hide mining activity. The malware mined cryptocurrency with **XMRig** and **emech**, and also included capabilities for **UDP/TCP floods, HTTP attacks, and port scanning**, indicating the operators were building a broader botnet that could support disruptive attacks beyond mining. ESET separately uncovered and helped disrupt **VictoryGate**, a Monero-mining botnet active since at least 2019 that infected at least **35,000 devices**, with more than **90%** of victims located in **Peru** and broader concentration in Latin America. VictoryGate spread mainly through **removable USB drives**, used **AutoIt-based droppers**, process injection, and **No-IP** dynamic DNS subdomains for command and control, and typically monetized infections through **XMRig** mining. After ESET reported the malicious No-IP subdomains, the provider took them down, cutting off the botnet’s ability to issue new commands or fetch additional payloads, although already infected hosts could continue mining.
Aug 15, 2026
Researchers identified a large cryptojacking operation that abused public container registries by uploading **30 malicious images** across **10 Docker Hub accounts**, which collectively recorded more than **20 million pulls**. The images were designed to deploy cryptocurrency miners on victim systems, with most samples mining **Monero** and frequently using the open-source miner **`XMRig`**. The campaign was tied to multiple Docker Hub accounts, including **`azurenql`**, **`021982`**, **`dockerxmrig`**, **`ggcloud1`**, and **`ggcloud2`**, which researchers assessed as part of the same broader operation. Attackers used multiple image tags to support different CPU architectures, operating systems, and miner variants, increasing compatibility and reach, and the observed mining activity was estimated to have generated roughly **$200,000** in cryptocurrency while indicating a wider malicious-image problem across public registries.
Aug 14, 2026