XMRig
XMRig is an open-source cryptocurrency miner, most commonly used to mine Monero (XMR), that is frequently repurposed and maliciously modified for cryptojacking campaigns on both Windows and Linux systems. The content shows XMRig being deployed as a primary payload or follow-on payload by multiple malware families and intrusion chains, including Orchard, Blue Mockingbird, Blitz, Outlaw/Dota, Prometei, Cliptomaner, MrbMiner, Librarian Ghouls, StealC-linked activity, DanaBot supply-chain activity, and opportunistic post-exploitation following exploitation of public-facing applications. Observed delivery vectors and installation methods include phishing and paste-and-run lures, compromised NPM packages, SQL Server compromise, brute-force attacks against MS SQL or SSH, malware loaders and downloaders, trojanized software and game cheats, and exploitation of vulnerabilities such as React2Shell and SAP CVE-2025-31324-related activity.
Across the referenced incidents, XMRig commonly runs as a Monero miner connecting to mining pools over ports such as 3333, and is often disguised as legitimate or system-related binaries such as conhost.exe, svchost.exe, csrss.exe, kswapd0, or Windows Update Service.exe. Several cases explicitly describe maliciously modified XMRig builds, including versions 6.15.2, 6.19.0, 6.22.1, and 6.19.0 embedded in Linux campaigns. Modifications and surrounding tradecraft include process hollowing, watchdog processes, persistence via Windows services, scheduled tasks, Run keys, WMI permanent event subscriptions, COR_PROFILER abuse, SSH authorized_keys replacement, cron persistence, and use of kernel drivers such as WinRing0x64.sys to improve mining performance. Some campaigns also relay XMRig JSON-RPC traffic through command-and-control infrastructure; Orchard, for example, used DGA-generated domains plus ojena.duckdns.org to control XMRig and forwarded unencrypted XMRig JSON-RPC traffic identifying XMRig/6.15.2.
The malware is associated with broad victimology rather than a single sector. The content places XMRig on enterprise servers, terminal servers, SQL servers, Linux hosts, cloud systems, industrial control system environments, and user workstations. It appears in financially motivated cryptojacking, mixed monetization chains that also include ransomware or credential theft, and commodity malware ecosystems where loaders or stealers deliver secondary payloads. Notable indicators directly mentioned in the content include ojena.duckdns.org, hxxp[://]23.95.123[.]5:666/xmrigCCall/8bq.sh, and mining-pool communications over port 3333. High-confidence file and path examples include C:\ProgramData\Microsoft\Crypto\conhost.exe, /var/tmp/.xlamb, and Linux miner filenames such as kswapd0. Overall, the content consistently characterizes XMRig as legitimate mining software that is widely abused or modified by threat actors for unauthorized resource hijacking and persistence.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
24 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The React2Shell vulnerability (CVE-2025–55182) was reported to the React team on November 29. Public advisories and patches dropped on December 3. Threat actors started exploiting it within hours... React2Shell (CVE-2025–55182) is a critical, unauthenticated remote code execution bug in React Server Components’ “Flight” protocol. | Common post-exploitation moves: Install XMRig or another cryptominer
Along with patching, we recommend examining SAP web server access logs for additional evidence of CVE-2025-31324 exploitation, specifically looking for evidence of unusual requests to the API endpoint /developmentserver/metadatauploader . If possible, consider disallowing access to that API endpoint from external networks. To hunt for additional evidence of web shell uploads, organizations can search for unexpected JSP files within these folders on SAP servers... | hxxp[://]23.95.123[.]5:666/xmrigCCall/8bq.sh
This service is accompanied by a pipe named \\.\WinRing0_1_2_0 which allows the process to communicate with the driver. This is quite an old driver, vulnerable to CVE-2020-14979 and CVE-2021-41285, and allowing the actor to elevate privileges to NT\SYSTEM as soon as the direct unchecked communication with the driver is allowed and the attacker controls input forwarded to the driver.
This service is accompanied by a pipe named \\.\WinRing0_1_2_0 which allows the process to communicate with the driver. This is quite an old driver, vulnerable to CVE-2020-14979 and CVE-2021-41285, and allowing the actor to elevate privileges to NT\SYSTEM as soon as the direct unchecked communication with the driver is allowed and the attacker controls input forwarded to the driver.
Ahnlab Security Emergency response Center (ASEC) has recently confirmed that the 8220 Gang attack group is using the Log4Shell vulnerability to install CoinMiner in VMware Horizon servers. Log4Shell (CVE-2021-44228) is both a remote code execution vulnerability and the Java-based logging utility Log4j vulnerability... | If the CVE-2022-26134 vulnerability attack succeeds, the following PowerShell command downloads and executes additional PowerShell scripts and ultimately installs XMRig CoinMiner.
The group targets not only global systems but also Korean ones. ASEC has introduced a case where the attack group abused the Atlassian Confluence server vulnerability CVE-2022-26134 to attack Korean systems and install CoinMiner. | If the CVE-2022-26134 vulnerability attack succeeds, the following PowerShell command downloads and executes additional PowerShell scripts and ultimately installs XMRig CoinMiner.
In this cluster of activity, since at least March 25, 2026, an XMRig sample and its accompanying configuration file were downloaded and deployed via a shell script.
In this cluster of activity, since at least March 25, 2026, an XMRig sample and its accompanying configuration file were downloaded and deployed via a shell script.
In this cluster of activity, since at least March 25, 2026, an XMRig sample and its accompanying configuration file were downloaded and deployed via a shell script.
Several devices initiated TCP connections to endpoints affiliated with cryptomining pools such as us[.]zephyr[.]herominers[.]com and xmrig[.]com. Connectivity to these domains indicates likely successful installation of mining software during earlier stages of post-compromise activity.
Several devices initiated TCP connections to endpoints affiliated with cryptomining pools such as us[.]zephyr[.]herominers[.]com and xmrig[.]com. Connectivity to these domains indicates likely successful installation of mining software during earlier stages of post-compromise activity.
CVE-2022-22954, a remote code execution (RCE) vulnerability due to server-side template injection in VMware Workspace ONE Access and Identity Manager, is trivial to exploit with a single HTTP request to a vulnerable device.
Apache RocketMQ Exploit Module (CVE-2023-33246) ... In June 2023, a vulnerability cataloged as CVE-2023-33246 was discovered that enables an attacker to achieve remote command execution (RCE) on RocketMQ versions 5.1.0 and earlier. Shortly after, DreamBus added an exploit module to target this vulnerability.
Metabase Exploit Module (CVE-2023-38646) ... The open source versions of Metabase 0.46.6.1 and earlier, as well as Metabase Enterprise 1.46.6.1 and earlier, are vulnerable to CVE-2023-38646 ... The vulnerability allows an attacker to execute arbitrary commands on the server. The DreamBus exploit targeting the vulnerability is likely based on an open source proof-of-concept.
The attack, at its core, exploits a critical missing authentication bug (CVE-2023-48022, CVSS score: 9.8) to take control of susceptible instances and hijack their computing power for illicit cryptocurrency mining using XMRig.
CVE-2026-20182 carries a CVSSv3.1 score of 10.0 (Critical) and is classified under CWE-287: Improper Authentication. The flaw affects the Cisco Catalyst SD-WAN Controller (formerly vSmart)... The peering authentication mechanism is not functioning correctly, allowing an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on the affected system.
Apr 2024 PAN-OS CVE-2024-3400 exploit integration (Akamai)
Analysis of react.py This script is clearly set to exploit CVE-2025-29927, also known as React2Shell. ... This script implements a fully automated React/Next.js exploitation pipeline centered on abusing CVE-2025-29927 to achieve remote command execution at scale.
Malware campaigns include the Muhstik botnet and XMRig Monero Cryptocurrency mining. | Drupal versions before 7.58... allow remote attackers to execute arbitrary code... Malware campaigns include the Muhstik botnet and XMRig Monero Cryptocurrency mining.
The PoC repository contained a PDF file... downloading and running three files: Xsession.sh → The main malware script; xsession.auth → A disguised Monero miner (XMRig); xprintidle → A utility to detect when the system was idle. | Late at night, I was testing a proof-of-concept (PoC) exploit for CVE-2020-35489 ... The script appears to be a simple Proof-of-Concept (PoC) for an exploit, but in reality, it contains hidden malicious functionality.
“CoinMiner XMRig, a CoinMiner that mines the Monero cryptocurrency, was the one the most used in the attacks.”
"x522, which kills competing miners such as XMRig and Kinsing, and launches the miner with a c3pool.org configuration"
The Kaswara Modern WPBakery Page Builder plugin (CVE-2021-24284) is an example of this. This is a five-year-old unpatched flaw in a long-abandoned plugin that attackers are still actively exploiting right now... This flaw allows an unauthenticated attacker to upload malicious code directly to a vulnerable server and execute it remotely. | "...attackers have been using this vulnerability to take over WordPress websites... to ultimately install unauthorized copies of the XMRig cryptomining software"
The vulnerability, assigned the CVE identifier CVE-2024-4577, refers to an argument injection vulnerability in PHP affecting Windows-based systems running in CGI mode that could allow remote attackers to run arbitrary code.
Groups observed using it
22 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.
The attackers establish remote access to the victim’s device, steal credentials, and deploy an XMRig crypto miner in the system.
By querying the hash on threat intelligence portals and by statically analyzing the sample, it became clear that this binary is a malicious modified version of XMRig (6.19.0), a cryptocurrency miner.
One of the campaigns deployed an XMRig cryptocurrency miner on a small number of infected machines, which is not standard behavior for a disciplined intelligence operation.
Impact T1496 Resource Hijacking TeamPCP kills competing XMRig cryptominers before deploying own payloads
If the CVE-2022-26134 vulnerability attack succeeds, the following PowerShell command downloads and executes additional PowerShell scripts and ultimately installs XMRig CoinMiner.
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
ClearFake is a fake browser update activity cluster that compromises legitimate websites with malicious HTML and JavaScript.
On October 22, 2021, a high-profile supply chain attack involving a compromised NPM package, ua-parser-js, distributed DanaBot — sub-botnet 40 — alongside XMRig. Two weeks after the October incident, on November 4, 2021, the same adversary leveraged another compromised NPM package, coa, to distribute DanaBot.
Execution
8 techniques
Execution
When it comes to persistence, Scheduled Task (T1053) ranked second overall... Blue Mockingbird leveraged multiple forms of persistence when deploying their primary payload... including: Scheduled Tasks (T1053).
WMI Filter named “BfeOnServiceStartTypeChange” was created to execute the event every Monday, Tuesday, Thursday, Friday and Saturday at 11:33 am Local time
Attackers tend to typically use “ActiveScriptEventConsumer” or “CommandLineEventConsumer” as both can be used to flexibly offer persistence on a system.
In most scenarios, once users interact with the Fix or Verify button in the lure, the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”
Event Consumer: Class Name: ASEventConsumerdr Content: VBScript file Reaching out to the domain mymst007[.]info on port 4000 Downloads the 2nd stage malware and saves it as a tmp file Executes the downloaded file which further executes a persistence command
The adversary is trying to entice the user into verifying or fixing something by typing a command into a terminal, run dialog box, or PowerShell.
Persistence
3 techniques
Persistence
When it comes to persistence, Scheduled Task (T1053) ranked second overall... Blue Mockingbird leveraged multiple forms of persistence when deploying their primary payload... including: Scheduled Tasks (T1053).
Privilege Escalation
4 techniques
Privilege Escalation
When it comes to persistence, Scheduled Task (T1053) ranked second overall... Blue Mockingbird leveraged multiple forms of persistence when deploying their primary payload... including: Scheduled Tasks (T1053).
WMI Filter named “BfeOnServiceStartTypeChange” was created to execute the event every Monday, Tuesday, Thursday, Friday and Saturday at 11:33 am Local time
Finally, the Blitz downloader checks whether the Windows application RuntimeBroker.exe is running, so it can inject the downloaded Blitz bot payload into the process... This C2 endpoint returns the Monero (XMR) cryptocurrency miner binary, which the bot injects into explorer.exe.
Stealth
5 techniques
Stealth
The MrbMiner cryptojacking payload included a kernel-level device driver (WinRing0x64.sys)... It gives the attacker access to features like the CPU’s model-specific register, and can read from or write to memory, directly.
Another file from the hidden directory, a/kswapd0, is an ELF packed using UPX...
Defense Evasion - маскировка под системный процесс (Masquerading, T1036), обфускация (Deobfuscate/Decode Files or Information, T1140), process injection в svchost.exe
Finally, the Blitz downloader checks whether the Windows application RuntimeBroker.exe is running, so it can inject the downloaded Blitz bot payload into the process... This C2 endpoint returns the Monero (XMR) cryptocurrency miner binary, which the bot injects into explorer.exe.
Discovery
1 technique
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
1 technique
Collection
Command and Control
3 techniques
Command and Control
The DGA domains — along with the hardcoded domain (ojena.duckdns.org) — are used to control XMRig. First, the client sends some fingerprinting information... The data is sent unencrypted to a hardcoded port, in my sample to port 25654.
Additionally, it has an optional loader functionality that can be used to retrieve additional payloads such as infostealers, remote access trojans (RATs) and ransomware... In one case, XTinyLoader was installed, which subsequently downloaded LockBit Black ransomware.
The first 16 domains are derived from the current date, while the next 16 domains are based on the Bitcoin block... The DGA itself is very simple: The seed string is MD5-hashed, then the hex representation of the hash is split into 4 strings of 8 characters to form the second level domains (sld). These 4 slds are then combined with 4 hardcoded top level domains to form 16 domains.
Impact
2 techniques
Impact
Interestingly enough, one of the first execution steps is checking if other known miners are present on the machine... If any miners are found, the script tries to kill and block their execution.
XMRig is an open-source software for mining cryptocurrencies like Monero or Bitcoin. It is also frequently used by cryptojacking malware to mine cryptocurrencies on victims’ computers... The DGA domains — along with the hardcoded domain (ojena.duckdns.org) — are used to control XMRig.
IOCs tracked for this family
358 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cryptomining payload observed among the additional payloads leveraged by StealC affiliates.
XMRig is listed as a payload delivered in StealC-linked activity.
A cryptomining malware/tool observed as a payload in StealC-related delivery chains.
XMRig was observed as a payload in StealC-related operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.