CryptoNightMalware
WebAssembly-based crpyto miner.From MISP Galaxy
Last reported 4 months ago, by Trend Micro Research1 report
ATT&CK techniques
6 of 41 · each with the sentence it comes from- T1014Rootkit
“That is a defensive move specifically aimed at rival rootkits.”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
- T1020Automated Exfiltration
“T1020 Automated Exfiltration”
- T1021.004SSH
“T1021.004 Remote Services: SSH”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1036Masquerading
“T1036.005 Masquerading: Match Legitimate Name or Location”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
From Langflow to Monero: Inside CVE-2026-33017 Cryptominer“It also declares support for 28 hashing algorithms including rx/0 (RandomX), the full cn-* CryptoNight family, argon2 variants, and ghostrider.”
Indicators in its reports
named in the reports above- 83.142.209[.]214in 1 report
- 94.156.64[.]241in 1 report
- 46096a72d84db5f1dafd944fcf6571c8in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.