Digging Gold with a Spoon โ Resurgence of Monero-mining Malware
A resurgence of malware deploying XMRig cryptominer was discovered in mid-April 2025, coinciding with a rally in Monero cryptocurrency value. The malware uses a multi-staged approach and LOLBAS techniques, leveraging Windows tools like PowerShell for payload delivery, detection evasion, and persistence. The attack chain involves three stages: initial infection via a batch file, persistence establishment, and cryptomining execution. The malware targets diverse countries, including Russia, Belgium, Greece, and China. It disables Windows Update services, evades Windows Defender, and uses scheduled tasks for persistence. The XMRig miner creates registry entries and drops files for continued operation. Despite its simple, unobfuscated nature, the malware proved effective in avoiding detection.
Pulse ID: 686bd1d71a879c051d569c88
Pulse Link: https://otx.alienvault.com/pulse/686bd1d71a879c051d569c88
Pulse Author: AlienVault
Created: 2025-07-07 13:55:35
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#China #CryptoMiner #CryptoMining #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #PowerShell #RAT #Russia #Windows #XMRigMiner #bot #cryptocurrency #AlienVault
