Loading malware…
PowerGhost is a Windows-focused cryptocurrency-mining malware family and botnet associated with illicit Monero mining. It is commonly referenced alongside other opportunistic miner operations such as WannaMine, MyKings, PCASTLE, and BULEHERO, and has been observed in the broader ecosystem of financially motivated cryptojacking activity targeting enterprise environments. PowerGhost is notable for worm-like propagation behavior and for using exploitation-based spread mechanisms associated with SMB vulnerabilities, including EternalBlue-style propagation in related reporting. It has also been identified by other miner malware as a competing infection to be removed or blocked from compromised hosts.
Operationally, PowerGhost is part of the class of miner malware that prioritizes resource hijacking and persistence on Windows systems. Reporting links it to miner-botnet tradecraft that includes post-compromise execution of cryptocurrency miners, and its infrastructure has appeared in contexts overlapping with other criminal campaigns. PowerGhost has also been referenced in relation to resurgence in cryptomining activity observed during periods of increased miner-botnet operations.
PowerGhost is primarily relevant as a cryptominer rather than a credential-focused threat. High-confidence reporting in the supplied material supports its role as a competing miner family targeted by other malware for process termination and host-file tampering, and supports association with EternalBlue-like propagation patterns seen in miner botnets. The available information does not establish a specific threat actor attribution with high confidence beyond its placement in the broader financially motivated cryptomining ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The EternalBlue script is very much the same as the implementation found in another miner botnet, Powerghost/Wannaminer.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Another miner botnet referenced because Kingminer's EternalBlue spreader closely resembles its implementation.
Previously associated malware/campaign referenced only through IOC domain attribution; mentioned as related infrastructure context rather than the main malware under discussion.
Cryptomining malware mentioned only as comparative background for broader miner resurgence.
Named cryptomining malware referenced as another competing miner family that GhostMiner attempts to disable by deleting related services, scheduled tasks, processes, and host-file entries.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.