Xmrig Miner

XMRig Miner is an open-source CPU/GPU miner software that supports numerous protocols. It's used in various cyber-attack campaigns to execute mining activities, often through the use of a dropper. The dropper is responsible for orchestrating the installation and execution of the legitimate application, I2P tooling, and XMRig miner. Utilizing I2P, the dropper downloads a custom XMRig miner and manages the mining operations. The dropper generates and executes a script to download, configure, and execute a copy of the XMRig miner. In some cases, the XMRig Download Script sends the miner a config via its native API. Threat actors have used XMRig miner in their attacks, often paralleling techniques from previous campaigns such as the yearlong campaign revealed by Wiz in July, which used Selenium Grid as a vector to deploy the XMRig miner. In these instances, attackers ensure all cloud monitoring and security services are terminated or deleted before beginning mining activities. They then download the XMRig miner and execute it via an ELF file payload, hijacking system resources in the process. The attackers also use multiple cron jobs to maintain persistence. For Windows operating systems, the attackers use a malicious script that downloads all the tools required for unpacking and executing the Xmrig miner. They leverage the Selenium WebDriver API to run Python with a reverse shell, deploying scripts to download a modified XMRig miner. The process "AddinProcess.exe" is created to host the XMRig miner, writing the XMRig payload within this process and running it. This activity underscores the adaptability of threat actors and the importance of maintaining robust cybersecurity measures to protect against such threats.