From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain

A sophisticated multi-stage infection chain was discovered through analysis of a system exhibiting frequent PowerShell execution alerts. The attack leveraged multiple layers of obfuscation and concealment techniques, including Registry-based payload storage, DNS TXT record exploitation, and data hidden within image and WAV audio files. The threat actors employed various evasion methods such as security control tampering and in-memory execution to avoid detection. Rather than writing payloads directly to disk, attackers reconstructed malicious code from distributed sources including Registry entries and steganographically encoded data in media files. The ultimate objective of this elaborate infection chain was to deploy cryptocurrency mining operations covertly on compromised systems while maintaining persistent access through multiple redundant mechanisms.

• From Business Emails to XLoader: An Order Lure That Led to In-Memory InjectionMalware2026-11-04
• Yoba Malware Campaign Abuses Signed AI Applications to Evade DetectionMalware2026-11-03
• BITTER Expands Its Arsenal with PapRATMalware2026-11-03
• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30
• Sandbox Flipped to 'Danger-Full-Access': Unauthorized AI Relays Create Risk for OrganizationsCampaign2026-10-29