Monero MinerMalware
- Coinminer
According to ESET, first seen in-the-wild on 26th May, 2017, the malicious mining software is a fork of a legitimate open source Monero CPU miner called xmrig.From MISP Galaxy
Last reported 17 days ago, by AhnLab ASEC6 reports
ATT&CK techniques
6 of 17 · each with the sentence it comes from- T1053Scheduled Task/Job
“PersistenceT1053.003 Scheduled Task/Job: CronCrontab ‘* * * * *’ and ‘@reboot’ entries relaunching .kworker_sys.”
- T1110Brute Force
“The report shows that the primary causes of database server attacks include not only the exploitation of vulnerabilities but also brute-force and dictionary attacks, as well as improper account management.”
- T1505.003Web Shell
“It also describes, through actual attack cases, the patterns in which web shells, backdoors, CoinMiner, and VPN tools are used in combination.”
- T1014Rootkit
“… successfully logging in, the threat actors downloaded and executed ShellBot using wget or curl, and subsequently installed a user-mode rootkit, XHide, and XMRig through a downloader.”
- T1036Masquerading
“Defense EvasionT1036.005 Masquerading: Match Legitimate Name or Locationsystemd-resolved, _chronyd, .kworker_sys, and a mail archive saved as .ico.”
- T1053.005Scheduled Task
“T1053.005 Scheduled Task/Job: Scheduled Task”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Q3 2026 Statistical Report on Malware Targeting Windows Database Servers“It also describes, through actual attack cases, the patterns in which web shells, backdoors, CoinMiner, and VPN tools are used in combination.”
-
Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026“BruteForceAttack CoinMiner DDoS DictionaryAttack Downloader Fisieredoor Gafgyt Honeypot 통계 launcher Linux Mirai P2PInfect Preload Prometei Rootkit XHide XMRig”
-
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570“Independently of that detector, Microsoft Defender Antivirus detected and quarantined Chopper, GodzillaWebShell, CoinMiner, Looptik, SuspGoLang, and Dirtelti payloads, and behavioral protection alerted on suspicious permission changes, background execution, dropped-and-launched f…”
-
Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)“This is similar to a cryptojacking attack, with the key difference being that instead of Proxyware, CoinMiner is installed to mine cryptocurrency using the infected system’s resources.”
-
July 2026 Security Issues in Korean & Global Financial Sector“In Stage 3, Infostealers (malware designed to steal information) were the most prevalent at 0.2, While Ransomware and CoinMiner each accounted for 0.1.”
-
It’s a trap: Detecting a cryptominer on a popular website using Group-IB MXDR“It was found that the archives contained an executable file, namely a dropper that installed a miner called XMRig Coinminer, which is used for mining the cryptocurrency Monero.”
Indicators in its reports
named in the reports above- hxxp://13.71.2[.]244/.x/xin 1 report
- check-host[.]netin 1 report
- 33251d1ec4f4ec19…4f0144259171in 1 report
- 87968d094b1722e6…f2828e667117in 1 report
- 6bc997af69c70233…f5f70fb411b5in 1 report
- chrome-error[.]coin 1 report
- d01b8765f1d2cf8d8722161b5ddfdc70in 1 report
- hxxps://gateway.pinata[.]cloud/ipfs/QmUVmisdxiY543hTd2SHkuRqSwDArBBjvcwD3wNm5zeZVDin 1 report
- gateway.pinata[.]cloudin 1 report
- hxxps://gateway.chrome-error[.]co/probe/v1/%E2%80%99,%E2%80%99then%E2%80%99,%E2%80%996481640KcopPX%E2%80%99,%E2%80%99src%E2%80%99,%E2%80%994548eMqYQQ%E2%80%99,%E2%80%99location%E2%80%99,%E2%80%996rZKPYZ%E2%80%99,%E2%80%99getAttribute%E2%80%99,%E2%80%99__exoclick__ads__show%E2%80%99,%E2%80%99split%E2%80%99,%E2%80%991243065zgUVSa%E2%80%99,%E2%80%99173080bsKStH%E2%80%99,%E2%80%996QQsqtI%E2%80%99,%E2%80%991651400hjUOci%E2%80%99,%E2%80%99http%E2%80%99in 1 report
- gateway.chrome-error[.]coin 1 report
- hxxps://gateway.chrome-error[.]co/payload/v1%E2%80%99in 1 report
- hxxps://gateway.chrome-error[.]co/probe/v1/undefined/in 1 report
- hxxps://gateway.chrome-error[.]co/payload/v1in 1 report
- hxxps://gateway.pinata[.]cloud/ipfs/QmcMovkgsDLcDn7SM1ifWwWZyaCjpoH7bCepmsb882AvZjin 1 report
- hxxps://gateway.pinata[.]cloud/ipfs/QmUBgSVFmhT1GU1YuoqDY7ZX47TWsWJBN3pLgbQF4jRjRZ%E2%80%9Din 1 report
- c122eba0264bfd7e383f015cecf59fbdin 1 report
- c16860e7bf4f4a33…c8eb04453995in 1 report
- hxxps://gateway.pinata[.]cloud/ipfs/QmUBgSVFmhT1GU1YuoqDY7ZX47TWsWJBN3pLgbQF4jRjRZin 1 report
- hxxps://cdnjs.cloudflare[.]com/ajax/libs/jszip/3.10.1/jszip.min.js%E2%80%99in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.