SecuriTricks - cryptomining

Examining Redtail: Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics

This analysis focuses on redtail, a cryptocurrency mining malware that stealthily installs itself on compromised systems. The malware utilizes two additional scripts: one to identify the CPU architecture and another to remove existing cryptomining software. Observed attacks originated from IP addre…

cryptomining

redtail

2025-01-09

c3pool_miner

Published: January 9, 2025

Downloadable IOCs: 12

PacketCrypt Classic Cryptocurrency Miner on PHP Servers

A cryptocurrency mining campaign targeting vulnerable PHP servers has been identified. The attack exploits misconfigured or unpatched servers, allowing unauthorized access to php-cgi.exe. The malware, initially delivered as dr0p.exe, downloads a secondary payload pkt1.exe, which then spawns packetc…

Published: January 7, 2025

Downloadable IOCs: 6

Unpacking the Diicot Malware Targeting Linux Environments

A new malware campaign attributed to the Romanian-speaking Diicot threat group has been discovered targeting Linux systems. The campaign shows significant advancements compared to previous iterations, including modified UPX headers with corrupted checksums, advanced payload staging, and environment…

Published: December 17, 2024

Downloadable IOCs: 36

Attacker Abuses Victim Resources to Reap Rewards from Titan Network

An attacker exploited the Atlassian Confluence vulnerability CVE-2023-22527 to achieve remote code execution for cryptomining via the Titan Network. The malicious actor gathered system details using public IP lookup services and various commands. Multiple shell scripts were downloaded and executed …

cryptomining

aws

ssh

remote code execution

Published: November 4, 2024

Downloadable IOCs: 1

Docker Gatling Gun Campaign

Recent research has uncovered a new malicious campaign orchestrated by the notorious hacking group TeamTNT. This campaign exploits exposed Docker daemons to deploy Sliver malware, a cyber worm, and cryptominers, utilizing compromised servers and Docker Hub as infrastructure for spreading their mali…

Published: October 29, 2024

Downloadable IOCs: 11

Using gRPC and HTTP/2 for Cryptominer Deployment: An Unconventional Approach

A malicious actor has been observed targeting Docker remote API servers to deploy the SRBMiner cryptominer for mining XRP cryptocurrency. The attacker utilizes the gRPC protocol over h2c (clear text HTTP/2 protocol) to evade security measures and execute cryptomining operations on Docker hosts. The…

Published: October 22, 2024

Downloadable IOCs: 2

LemonDuck Unleashes Cryptomining Attacks Through SMB Service Exploits

This report details the tactics and techniques employed by the LemonDuck cryptomining malware, which exploits the SMB service by leveraging the EternalBlue vulnerability (CVE-2017-0144). After gaining initial access through brute-force attacks, the malware creates malicious files, disables security…

Published: October 14, 2024

Downloadable IOCs: 8

LemonDuck Malware Exploiting SMB Vulnerabilities

LemonDuck malware has evolved into a versatile threat, targeting both Windows and Linux systems. It exploits SMB vulnerabilities, particularly EternalBlue, to gain network access. The malware uses brute-force attacks, creates hidden administrative shares, and executes malicious actions via batch fi…

Published: October 9, 2024

Downloadable IOCs: 5

SIEM agent being used in SilentCryptoMiner attacks

A global malware campaign targeting mainly Russian-speaking users has been distributing cryptocurrency mining malware through fake software download sites, Telegram channels, and YouTube videos. The multi-stage infection chain uses unusual techniques for persistence and evasion, including hiding ma…

Published: October 7, 2024

Downloadable IOCs: 8

perfctl: A Stealthy Malware Targeting Millions of Linux Servers

A sophisticated Linux malware named 'perfctl' has been actively targeting millions of servers worldwide for the past 3-4 years. It exploits over 20,000 types of misconfigurations to compromise Linux systems. The malware employs advanced evasion techniques, including rootkits, process masquerading, …

Published: October 4, 2024

Downloadable IOCs: 9

Hadooken and K4Spreader: The 8220 Gang's Latest Arsenal

This analysis uncovers a significant infection chain targeting Windows and Linux systems through Oracle WebLogic vulnerabilities. The attackers, likely the 8220 Gang, exploit CVE-2017-10271 and CVE-2020-14883 to deploy malware including K4Spreader, Tsunami backdoor, and cryptominers. The infection …

Published: October 1, 2024

Downloadable IOCs: 62

From Automation to Exploitation: The Growing Misuse of Selenium Grid for Cryptomining and Proxyjacking

Two campaigns targeting Selenium Grid, a popular web testing tool, have been identified. The attacks exploit misconfigured instances lacking authentication to deploy cryptominers and proxyjacking tools. The first campaign injects a base64 encoded Python script to download and execute a reverse shel…

cryptomining

vulnerability exploitation

Published: September 17, 2024

Downloadable IOCs: 18

Cryptomining Campaign Exploiting Grid Services

Wiz researchers discovered an ongoing threat campaign, dubbed 'SeleniumGreed', that exploits exposed Selenium Grid services for cryptomining. The campaign targets publicly accessible instances of Selenium Grid, an integral component of the widely used Selenium testing framework. By leveraging featu…

Published: July 30, 2024

Downloadable IOCs: 14

Unveiling a Crypto Mining Operation

This report uncovers a sophisticated intrusion campaign involving several malicious modules designed to disable security solutions and execute a persistent crypto-miner. The primary payload, dubbed GHOSTENGINE, leverages vulnerable drivers to terminate and delete known endpoint detection and respon…

Published: May 22, 2024

Downloadable IOCs: 17

Tag: cryptomining

Attack reports

Stopping Sobolan Malware with Aqua Runtime Protection

Infostealer Campaign against ISPs

StaryDobry campaign targets gamers with XMRig miner

Examining Redtail: Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics

PacketCrypt Classic Cryptocurrency Miner on PHP Servers

Unpacking the Diicot Malware Targeting Linux Environments

Attacker Abuses Victim Resources to Reap Rewards from Titan Network

Docker Gatling Gun Campaign

Using gRPC and HTTP/2 for Cryptominer Deployment: An Unconventional Approach

LemonDuck Unleashes Cryptomining Attacks Through SMB Service Exploits

LemonDuck Malware Exploiting SMB Vulnerabilities

SIEM agent being used in SilentCryptoMiner attacks

perfctl: A Stealthy Malware Targeting Millions of Linux Servers

Hadooken and K4Spreader: The 8220 Gang's Latest Arsenal

From Automation to Exploitation: The Growing Misuse of Selenium Grid for Cryptomining and Proxyjacking

Cryptomining Campaign Exploiting Grid Services

Unveiling a Crypto Mining Operation