Loading story…
Researchers identified a multi-stage, fileless-leaning Windows malware chain that stores PowerShell payloads in the Registry and hides later stages in DNS TXT records, PNG images, ZIP archives, and WAV files. The malware reconstructs .NET assemblies and loads an XMRig cryptocurrency miner directly into memory, configured for RandomX mining with up to 40 CPU threads and a TLS-connected mining pool.
The infection establishes persistence through hidden scheduled tasks and a permanent WMI event subscription, while attempting to weaken Microsoft Defender controls and erase PowerShell history. It uses DNS-over-HTTPS via Google DNS alongside HTTP/HTTPS communications for command-and-control and host identification; researchers warned that this active C2 channel could also deliver commands or payloads beyond cryptomining.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
K7 Computing Labs published an analysis of a Windows infection chain that used Registry-resident PowerShell, DNS TXT records, PNG steganography, and WAV containers to deliver an in-memory XMRig miner. The report documented scheduled-task and WMI persistence, Microsoft Defender impairment, DNS-over-HTTPS command-and-control, and associated infrastructure and indicators.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the open-source **XMRig** Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable **RDP** access, deploy **Trojan-Ransom.Win32.Crusis**, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers. Telemetry showed more than **5,000** attempts in August 2020 to install XMRig or modified variants, with **Prometei** and **Cliptomaner** identified as major distributors. Prometei brute-forced **MS SQL** credentials, abused `xp_cmdshell` and **`CVE-2016-0099`**, and used a cross-platform **.NET Core/Apphost** loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as **Realtek** audio software, was written in **AutoIT**, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Jun 29, 2026
Researchers reported that **GhostMiner** evolved into a fileless cryptocurrency-mining malware strain that abuses **Windows Management Instrumentation (WMI)** for persistence, payload execution, and evasion on Windows systems. The malware stores Base64-encoded PowerShell in a WMI class named `PowerShell_Command`, installs WMI event subscriptions to relaunch itself, drops a Monero miner as `C:\Windows\Temp\lsass.exe`, and maintains backdoor communication with command-and-control infrastructure including `118.24.63.208` and `103.105.59.68`. The campaign also aggressively removes rival cryptominers by terminating competing processes and services, deleting scheduled tasks, blocking related network traffic, and altering hosts file entries tied to families such as **MyKings**, **PowerGhost**, **PCASTLE**, and **BULEHERO**. The activity aligns with the broader **MITRE ATT&CK `T1546.003`** technique, which documents WMI event subscription abuse as a persistence method used by multiple malware families and threat actors, underscoring how GhostMiner weaponized native Windows management features to remain resident while monopolizing infected hosts for illicit Monero mining.
Aug 15, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026