Xmrig

XMRig is a high-performance mining software used for cryptocurrency, particularly Monero. This software has been utilized in various cyber attacks to exploit system resources and conduct cryptojacking activities. The operation begins with a dropper, which is responsible for the orchestration of the installation and execution of legitimate applications like the I2P tooling and the XMRig miner. Utilizing I2P, the dropper downloads a custom XMRig miner and manages the mining operations. Both i2pd and XMRig use legitimate file paths to mask their execution, making detection more challenging. The significant impact of these attacks is resource hijacking, where the XMRig miner exhausts the server's CPU resources. This situation occurs whether it's third-party proxyware or the XMRig Monero miner that perfctl drops onto a compromised server. Once the attacker has assembled their botnet, they can then use it for future malicious but profitable activities such as cryptocurrency mining, DDOS attacks, spam distribution, and data theft. The Dota3 botnet, known for its involvement in cryptojacking, deploys XMRig agents to compromised systems, indicating its primary purpose is to engage in crypto mining. The attack process involves several steps. Initially, the "check.sh" script creates necessary directories and verifies if the host hasn't been infected yet. If the host is the first to be infected, it downloads the "config.sh" from the attacker's IP and the XMRig coin miner from Github. The miner sets the pool URL with credentials using "config.json". To maintain persistence, the attacker uses multiple cron jobs, downloads the XMRig miner, and ensures all security tools are disabled before starting mining activities. A notable example is the exploitation of the critical vulnerability CVE-2023-22527 for cryptojacking activities, as reported by Trend Micro. After ensuring all cloud monitoring and security services are terminated or deleted, the attacker terminates the entry point process that exploits CVE-2023-22527 and downloads the XMRig miner to begin mining activities.