MalwarePublished 7 Jul 2025

Digging Gold with a Spoon – Resurgence of Monero-mining Malware

Source AlienVault OTX General

Description

A resurgence of malware deploying XMRig cryptominer was discovered in mid-April 2025, coinciding with a rally in Monero cryptocurrency value. The malware uses a multi-staged approach and LOLBAS techniques, leveraging Windows tools like PowerShell for payload delivery, detection evasion, and persistence. The attack chain involves three stages: initial infection via a batch file, persistence establishment, and cryptomining execution. The malware targets diverse countries, including Russia, Belgium, Greece, and China. It disables Windows Update services, evades Windows Defender, and uses scheduled tasks for persistence. The XMRig miner creates registry entries and drops files for continued operation. Despite its simple, unobfuscated nature, the malware proved effective in avoiding detection.

Impact

For European organizations, this malware poses a significant risk primarily in terms of resource consumption and operational disruption. The cryptomining activity consumes CPU and GPU resources, leading to degraded system performance, increased power consumption, and potential hardware wear. Disabling Windows Update services increases the risk of exposure to other vulnerabilities due to lack of timely patches. Evading Windows Defender and using LOLBAS techniques complicate detection and remediation efforts, potentially allowing the malware to persist undetected for extended periods. While the malware does not appear to directly exfiltrate data or cause destructive damage, the operational costs and security risks associated with compromised systems can be substantial. In sectors with critical infrastructure or sensitive data, the presence of such malware could be a precursor to more severe attacks or indicate broader security weaknesses. Additionally, the malware’s presence can undermine trust in IT systems and lead to increased incident response costs. Given its targeting of Belgium and Greece among European countries, organizations in these countries should be particularly vigilant. The malware’s disabling of security features and persistence mechanisms also increase the risk of secondary infections or lateral movement within networks.

Defensive guidance

To mitigate this threat, European organizations should implement a multi-layered defense strategy that includes: 1) Enforce strict application control policies to prevent execution of unauthorized batch files and scripts, especially those delivered via email or removable media. 2) Monitor and restrict the use of PowerShell and other scripting tools by applying constrained language mode or logging and alerting on suspicious PowerShell activity. 3) Regularly audit scheduled tasks and registry entries for unauthorized modifications indicative of persistence mechanisms. 4) Ensure Windows Update services remain enabled and are not tampered with; implement monitoring to detect service stoppages or configuration changes. 5) Deploy endpoint detection and response (EDR) solutions capable of detecting LOLBAS abuse and anomalous cryptomining behavior, including unusual CPU usage patterns. 6) Use threat intelligence feeds to block known malicious domains such as notif.su and monitor network traffic for connections to suspicious infrastructure. 7) Educate users on the risks of executing unknown batch files and attachments to reduce initial infection vectors. 8) Implement network segmentation to limit the spread and impact of infections. 9) Conduct regular vulnerability assessments and penetration testing to identify and remediate security gaps that could be exploited for initial infection. 10) Maintain up-to-date backups and incident response plans to enable rapid recovery if infection occurs.

Indicators of compromise

Domains 1

notif.su

Hashes 3

3acf8d410f30186a800d5e8c3b0b061a6faf7c0939b129d230de42e9034ce6c3
a57688c151a42d8a2b78f72d23ae7e6c2d6a458edd50f0a4649cc630614763b0
f4386aaa87c922d5d7db28d808ad6471b1c4deb95d82a9e6cfe8421196c5610b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Jul 2025, 21:24 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 3

Community reviews

Related threats