Loading story…
A cryptocurrency-mining campaign dubbed RubyMiner attempted to compromise web servers across 30% of networks worldwide within 24 hours, according to Check Point Research’s January 2018 report. The reportedly lone attacker exploited older vulnerabilities affecting PHP, Microsoft IIS, and Ruby on Rails to deploy a modified XMRig miner for Monero. Approximately 700 servers had reportedly joined the attacker’s mining pool by publication, generating about $540; the 30% figure described attempted attacks, not confirmed infections.
The infection chain removed existing cron jobs and installed an hourly task that downloaded and executed malicious content disguised as a robots.txt file. The campaign demonstrated how long-known vulnerabilities in publicly exposed servers could enable unauthorized mining and recurring malicious execution. Defenders should prioritize patching internet-facing web servers, investigate unexpected mining processes and scheduled-task changes, and review suspicious downloads masquerading as robots.txt.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
In early 2018, a reportedly lone attacker attempted to compromise PHP, Microsoft IIS, and Ruby on Rails servers across 30% of worldwide networks within 24 hours, exploiting older vulnerabilities to deploy a modified XMRig Monero miner. Approximately 700 servers had joined the mining pool by the time of the report, generating about $540.
A 2013 attack exploiting a Ruby on Rails vulnerability used lochjol[.]com, a domain later observed in the RubyMiner campaign. Researchers could not establish a connection or common attacker between the two attacks.
Check Point reported that RubyMiner removed existing cron jobs and installed an hourly task that downloaded internetresearch[.]is/robots.txt and executed its contents with bash. The report also detailed exploitation of CVE-2013-0156 and published attack infrastructure indicators and payload hashes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Sysrv-hello cryptomining botnet compromises vulnerable Windows and Linux enterprise servers to deploy XMRig Monero miners and spread to additional systems. Observed since December 2020, it exploits remote code execution vulnerabilities in internet-facing applications and reuses SSH keys recovered from compromised servers for lateral movement. The malware evolved from separate mining and propagation components into a single binary and removes competing cryptocurrency miners from infected hosts. Researchers identified mining wallets associated with F2Pool and Nanopool, indicating illicit cryptocurrency earnings. Follow-up reporting from Juniper and Lacework highlighted persistence and infrastructure expansion, respectively, extending concerns beyond the botnet’s initial exploitation activity. The combination of application exploitation, credential reuse, and self-propagation exposes organizations to unauthorized compute consumption and broader server compromise. Defenders should prioritize patching exposed applications, investigate unexpected mining processes and resource usage, and audit SSH access. Compromised SSH keys should be revoked or rotated, while affected hosts should be checked for persistence and evidence of lateral movement.
Oct 9, 2026
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Attackers built a cryptojacking botnet by exploiting **`CVE-2017-7269`**, a WebDAV buffer overflow in unpatched **Microsoft IIS 6.0** servers running on **Windows Server 2003**. The campaign, active since at least May 2017, used internet-wide scanning from **Amazon Web Services-hosted IP addresses** to find vulnerable systems and then delivered shellcode that downloaded and executed a minimally modified version of the open-source **`xmrig`** miner. The compromised servers were used to mine **Monero**, with the operation reportedly growing to several hundred machines and generating more than **420 XMR**, worth over **$63,000** at the time. ESET said it detected the miner as **`Win32/CoinMiner.AMW`** and the exploit traffic as **`webDAV/ExplodingCan`**, and urged administrators to apply Microsoft patch **`KB3197835`** and other critical updates to protect exposed legacy servers.
Aug 14, 2026