Xmrig Miner

The XMRig miner is a type of malware that is used to exploit computer systems for cryptocurrency mining. It is an open-source CPU/GPU miner supporting numerous protocols, and is typically installed through a dropper, which orchestrates the installation and execution of the miner. The dropper also installs I2P tooling, a legitimate application, and utilizes I2P to download a custom XMRig miner, coordinating the mining operations. This process involves the generation and execution of a script to download, configure, and execute a copy of the XMRig miner. In some instances, the XMRig Download Script sends the miner a configuration via its native API. This malware parallels a yearlong campaign revealed by Wiz in July, which used Selenium Grid as a vector to deploy the XMRig miner. The attackers use multiple cron jobs to maintain persistence, disable all security tools, and then download the XMRig miner to begin mining activities. For Windows operating systems, the threat actors use a malicious script that downloads all the necessary tools for unpacking and executing the Xmrig miner. They leverage the Selenium WebDriver API to run Python with a reverse shell, deploying scripts to download a modified version of the XMRig miner. The first threat actor using the XMRig miner executes mining activity via an ELF file payload. After ensuring all cloud monitoring and security services are terminated or deleted, the attacker exploits CVE-2023-22527, terminates the entry point process, and downloads the XMRig miner to begin mining activities. This process hijacks system resources, disrupting normal operations. The attack includes creating an “AddinProcess.exe” process that hosts the XMRig miner, writing the XMRig payload within this process, and running it.