#xmrig — Public Fediverse posts

Suwek, hashrate #xmrig #p2pool #monero gua drop gara-gara pada nebeng beban ke server gua.

Sing sabar, ingat orang sabar pasti kesal 🤪

Saw a new (to me) malware sample in teh logs. A python script scanning for exposed docker APIs deploying xmrig:

hxxps://pastebin[.]com/raw/1p7TJRDd

#malware #python #docker #xmrig

Saw a new (to me) malware sample in teh logs. A python script scanning for exposed docker APIs deploying xmrig:

hxxps://pastebin[.]com/raw/1p7TJRDd

#malware #python #docker #xmrig

Je viens de changer le bloc ventilateur/radiateur de mon #Framework Laptop 13, et le CPU n'a jamais été aussi froid!

85°C en pleine charge avec le Core Ultra 5 125H, c'est beaucoup mieux que les 105°C que j'avais avant.

J'ai enfin retrouvé les 4KH/s avec #xmrig.

#framework13

So I was experimenting with #XMrig yesterday; was thinking of using my Ryzen 9 mini PC to do some #Monero mining. I noticed a status message that said something about the hash rate being limited because of lack of access to an "MSR Mod". Apparently the "fix" for this is to run xmrig as root and disable secure boot.

Call me paranoid, but that seems really suspicious. I aint giving no third party software root privileges.

#Security

So I was experimenting with #XMrig yesterday; was thinking of using my Ryzen 9 mini PC to do some #Monero mining. I noticed a status message that said something about the hash rate being limited because of lack of access to an "MSR Mod". Apparently the "fix" for this is to run xmrig as root and disable secure boot.

Call me paranoid, but that seems really suspicious. I aint giving no third party software root privileges.

#Security

Warning - If you run a #librewolf docker on #unraid then you are exposing yourself to #xmrig #crypomining #malware

Please be aware of this!

Warning - If you run a #librewolf docker on #unraid then you are exposing yourself to #xmrig #crypomining #malware

Please be aware of this!

Да, **P2Pool** — лучший вариант для майнинга Monero без необходимости доверять централизованным пулам. Он сочетает **децентрализацию, анонимность и устойчивость к цензуре**.

https://matrix.to/#/!HdSCQbJtfHHCalgemp:matrix.org/$g2kgrP6XnA4fwxDxxPsKa5QXTSvXrQXWQQDqrnOsj8g?via=matrix.org&via=matrix.kyiv.dcomm.net.ua

### **Почему P2Pool выгоден?**
✅ **Децентрализованный:** Нет админов, которые могут украсть выплаты или манипулировать наградами.
✅ **Низкие комиссии:** Всего **0.9%**, которые идут на поддержание сети.
✅ **Прямая выплата на кошелек:** Никаких минимальных балансов и задержек — монеты сразу на твоем XMR-адресе.
✅ **Приватность:** Не требует KYC, IP можно скрыть через Tor или VPN.

### **Как начать без танцев с бубном?**
1. **Установи кошелек** (лучше GUI-кошелек от Monero или Feather Wallet).
2. **Скачай майнер** ([XMRig](https://xmrig.com) — лучший вариант).
3. **Настрой соединение с P2Pool**:
- **Адрес пула**: `127.0.0.1:37889` (локальный P2Pool-нода).
- **Твой XMR-кошелек в качестве логина**.
4. **Запусти P2Pool-ноду** ([инструкция](https://p2pool.io/#getting-started)).
5. **Запусти XMRig** и майнь без посредников!
⚡ **P2Pool — это как Биткойн-ноды, только для Monero:** полная автономность, никаких посредников и максимальная приватность.

#Monero #XMR #CryptoMining #P2Pool #Privacy #Decentralization #NoKYC #Mining #AnonCrypto #XMRig

Security Week 2509: компьютерные игры с вредоносным кодом

Сразу две новости прошлой недели сообщают о новых случаях распространения компьютерных игр с вредоносным кодом внутри. Исследование специалистов «Лаборатории Касперского» разбирает масштабную вредоносную кампанию, в ходе которой на популярных торрент-трекерах распространялись версии игр со встроенной троянской программой. Заряженные дистрибутивы компьютерных игр распространялись на торрентах начиная с сентября 2024 года. В список зараженных игр входили BeamNG.drive, Garry’s Mod, Dyson Sphere Program, Universe Sandbox и Plutocracy, причем, по данным «Лаборатории Касперского», наибольшее число заражений пришлось на игру BeamNG.drive. Большинство атак зафиксировано на пользователей из России, но инциденты наблюдались также в Беларуси, Казахстане, Германии и Бразилии. Целью этой разовой кампании были относительно мощные игровые компьютеры, на которые устанавливался майнер криптовалюты.

https://habr.com/ru/companies/kaspersky/articles/885284/

#xmrig #steam

StaryDobry ruins New Year’s Eve, delivering miner instead of presents – Source: securelist.com https://ciso2ciso.com/starydobry-ruins-new-years-eve-delivering-miner-instead-of-presents-source-securelist-com/ #rssfeedpostgeneratorecho #MalwareDescriptions #MalwareTechnologies #CyberSecurityNews #Financialthreats #Windowsmalware #Gamingmalware #securelistcom #spoofing #Malware #Torrent #Trojan #Miner #XMrig #DLL

StaryDobry ruins New Year’s Eve, delivering miner instead of presents – Source: securelist.com https://ciso2ciso.com/starydobry-ruins-new-years-eve-delivering-miner-instead-of-presents-source-securelist-com/ #rssfeedpostgeneratorecho #MalwareDescriptions #MalwareTechnologies #CyberSecurityNews #Financialthreats #Windowsmalware #Gamingmalware #securelistcom #spoofing #Malware #Torrent #Trojan #Miner #XMrig #DLL

📬 CrowdStrike-Phishing: Jobsuchende bekommen Crypto-Miner untergeschoben
#ITSicherheit #Malware #Crowdstrike #CrowdStrikePhishing #CryptoMiningMalware #Phishing #PhishingAngriff #XMRig https://sc.tarnkappe.info/83c4fd

📬 CrowdStrike-Phishing: Jobsuchende bekommen Crypto-Miner untergeschoben
#ITSicherheit #Malware #Crowdstrike #CrowdStrikePhishing #CryptoMiningMalware #Phishing #PhishingAngriff #XMRig https://sc.tarnkappe.info/83c4fd

Supply Chain Attack Hits Rspack, Vant npm Packages with Monero Miner – Source:hackread.com https://ciso2ciso.com/supply-chain-attack-hits-rspack-vant-npm-packages-with-monero-miner-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #CyberAttacks #CyberAttack #Hackread #security #malware #Monero #Python #XMRig #NPM

Supply Chain Attack Hits Rspack, Vant npm Packages with Monero Miner – Source:hackread.com https://ciso2ciso.com/supply-chain-attack-hits-rspack-vant-npm-packages-with-monero-miner-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #CyberAttacks #CyberAttack #Hackread #security #malware #Monero #Python #XMRig #NPM

Supply Chain Attack Hits Rspack, Vant npm Packages with Monero Miner https://hackread.com/supply-chain-attack-rspack-vant-npm-monero-miner/ #Cybersecurity #Vulnerability #CyberAttacks #CyberAttack #Security #Malware #Monero #Python #XMRig #NPM

Supply Chain Attack Hits Rspack, Vant npm Packages with Monero Miner https://hackread.com/supply-chain-attack-rspack-vant-npm-monero-miner/ #Cybersecurity #Vulnerability #CyberAttacks #CyberAttack #Security #Malware #Monero #Python #XMRig #NPM

Part 3 of my #cryptominer infection saga.

Being too lazy to secure my infected #prometheus container, I was looking for another way to combat it.
Killing it did now work because it's CnC was bringing it up in under a minute.

My "fix" is inspired if I say so myself.
Is to run a cronjob to set nice setting to the lowest possible
(nice -n 19 xmrig)
This makes the #xmrig crapto miner at the least possible CPU priority.

See if you can see on my attached performance chart, when it kicks in
😁
#infosec

With crapto hitting all time highs, #xmrig is back on the menu. I configured one of my Lab #docker stack #vps rather lazily and of course it got infected.

Because I'm lazy, rather than secure the stack, I'm CRONenberging the process every x-minutes.

#infosec #sploits

Hackers maken misbruik van docker api voor cryptojacking https://www.trendingtech.news/trending-news/2024/10/39932/hackers-maken-misbruik-van-docker-api-voor-cryptojacking #Docker #cryptojacking #cybersecurity #malware #XMRig #Trending #News #Nieuws

Thanks to (very patient) contributors, our new #xmrig container is now ready!

Works with CPU and/or CUDA.

https://github.com/metal3d/docker-xmrig/pkgs/container/xmrig/281208457?tag=v6.22.0

This is a destructive OPSEC failure.
PoC code is trivial to find along with a simple Censys query to uncover vulnerable hosts. The code itself supports a TXT file of URLs so....spray and pray method to find targets. Certain campaigns used #XMRig, GoThief, and backdoors like #Gh0stRAT and #PlugX.

It should go without saying to not make your file servers open to the public but some didn't get the memo.
#HFS #CVE202423692 #ThreatIntel

https://asec.ahnlab.com/en/67650/

This is a destructive OPSEC failure.
PoC code is trivial to find along with a simple Censys query to uncover vulnerable hosts. The code itself supports a TXT file of URLs so....spray and pray method to find targets. Certain campaigns used #XMRig, GoThief, and backdoors like #Gh0stRAT and #PlugX.

It should go without saying to not make your file servers open to the public but some didn't get the memo.
#HFS #CVE202423692 #ThreatIntel

https://asec.ahnlab.com/en/67650/

Happy Friday everyone!

#Cryptominers and #CVE20173506 is featured in today's #readoftheday! Trend Micro takes us through a riveting tale where the protagonist, #WaterSigbin, abuses a vulnerability in Oracle WebLogic Servers. After exploitation, a Base64-encoded payload is run that drops the initial stage loader named "wireguard2-3.exe", which masquerades itself as a legitimate VPN technology to help with it's defense evasion. It also plays a role in getting the attack to the next stages which involve DLL-reflection, C2 communication, and finally the #XMRig cyrptominer.

Significant details that are included is a scheduled task created for Windows Defender exclusion, some discovery using WMI, and another scheduled task for persistence. As usual, I am not going to spoil it all, go and have a read for yourself! Enjoy and Happy Hunting!

Notable MITRE ATT&CK TTPs (thanks to the authors):
TA0001 - Initial Access
T1190 - Exploit Public-Facing Application

TA0002 - Execution
T1059.001 - Command and Scripting Interpreter: PowerShell
T1047 - Windows Management Instumentation

TA0005 - Defense Evasion
T1620 - Reflective Code Loading
T1036.005 - Masquerading: Match Legitimate Name or Location
T1562.001 - Impair Defenses: Disable or Modify Tools

TA0003 - Persistence
T1053.005 - Scheduled Task/Job: Scheduled Task

TA0011 - Command And Control
T1571 - Non-Standard Port
T1071 - Application Layer Protocol

TA0007 - Discovery
T1057 - Process Discovery
T1012 - Query Registry

Examining Water Sigbin's Infection Routine Leading to an XMRig Cryptominer
https://www.trendmicro.com/en_us/research/24/f/water-sigbin-xmrig.html

Intel 471 #CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #gethunting

Happy Friday everyone!

#Cryptominers and #CVE20173506 is featured in today's #readoftheday! Trend Micro takes us through a riveting tale where the protagonist, #WaterSigbin, abuses a vulnerability in Oracle WebLogic Servers. After exploitation, a Base64-encoded payload is run that drops the initial stage loader named "wireguard2-3.exe", which masquerades itself as a legitimate VPN technology to help with it's defense evasion. It also plays a role in getting the attack to the next stages which involve DLL-reflection, C2 communication, and finally the #XMRig cyrptominer.

Significant details that are included is a scheduled task created for Windows Defender exclusion, some discovery using WMI, and another scheduled task for persistence. As usual, I am not going to spoil it all, go and have a read for yourself! Enjoy and Happy Hunting!

Notable MITRE ATT&CK TTPs (thanks to the authors):
TA0001 - Initial Access
T1190 - Exploit Public-Facing Application

TA0002 - Execution
T1059.001 - Command and Scripting Interpreter: PowerShell
T1047 - Windows Management Instumentation

TA0005 - Defense Evasion
T1620 - Reflective Code Loading
T1036.005 - Masquerading: Match Legitimate Name or Location
T1562.001 - Impair Defenses: Disable or Modify Tools

TA0003 - Persistence
T1053.005 - Scheduled Task/Job: Scheduled Task

TA0011 - Command And Control
T1571 - Non-Standard Port
T1071 - Application Layer Protocol

TA0007 - Discovery
T1057 - Process Discovery
T1012 - Query Registry

Examining Water Sigbin's Infection Routine Leading to an XMRig Cryptominer
https://www.trendmicro.com/en_us/research/24/f/water-sigbin-xmrig.html

Intel 471 #CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #gethunting

📬 PS4-Emulator installiert CoinMiner XMRig
#Malware #AhnLabSecurity #ASEC #CoinMiner #Playstation #PS4Emulator #XMRig https://sc.tarnkappe.info/2aa3fe

📬 PS4-Emulator installiert CoinMiner XMRig
#Malware #AhnLabSecurity #ASEC #CoinMiner #Playstation #PS4Emulator #XMRig https://sc.tarnkappe.info/2aa3fe

SonicWall warns of a cryptominer disguised as a Java Access Bridge installation installer package, but doesn't provide IOC. 🔗 https://blog.sonicwall.com/en-us/2024/04/cryptominer-poses-as-fake-java-utility/

#XMrig #malware

SonicWall warns of a cryptominer disguised as a Java Access Bridge installation installer package, but doesn't provide IOC. 🔗 https://blog.sonicwall.com/en-us/2024/04/cryptominer-poses-as-fake-java-utility/

#XMrig #malware

Exploitation of CVE-2024-27198 (9.8, disclosed on 04 March 2024 by JetBrains, has Proof of Concept, in KEV Catalog 07 March 2024: auth bypass in TeamCity) has been observed by Trend Micro to drop Jasmin ransomware, XMRig cryptocurrency miner, SparkRAT backdoor, and Cobalt Strike beacons. MITRE ATT&CK TTPs and IOC provided. 🔗 https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html

#CVE_2024_27198 #KEV #CISA #JetBrains #TeamCity #vulnerability #eitw #activeexploitation #ransomware #threatintel #Jasmin #XMrig #cryptomining #SparkRAT #CobaltStrike #IOC #threatintel #proofofconcept

Exploitation of CVE-2024-27198 (9.8, disclosed on 04 March 2024 by JetBrains, has Proof of Concept, in KEV Catalog 07 March 2024: auth bypass in TeamCity) has been observed by Trend Micro to drop Jasmin ransomware, XMRig cryptocurrency miner, SparkRAT backdoor, and Cobalt Strike beacons. MITRE ATT&CK TTPs and IOC provided. 🔗 https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html

#CVE_2024_27198 #KEV #CISA #JetBrains #TeamCity #vulnerability #eitw #activeexploitation #ransomware #threatintel #Jasmin #XMrig #cryptomining #SparkRAT #CobaltStrike #IOC #threatintel #proofofconcept

Mining Monero can be as simple or complicated as you want it to be.

https://theprivacydad.com/mining-monero/

#moneronodo #monero #P2Pool #xmrig #xmr #mining

Mining Monero can be as simple or complicated as you want it to be.

https://theprivacydad.com/mining-monero/

#moneronodo #monero #P2Pool #xmrig #xmr #mining

CPU Mining on a Raspberry Pi using #XMRig #cpumining #crypto

https://technical.izndgroup.com/2020/08/cpu-mining-on-raspberry-pi-xmrig.html

@kubikpixel Erinnert mich an so manche #malware die sich per non-persistence von Erkennung und Bekämpfung schützt.

#xmrig ohne sudo und mit geringster Priorität hat extrem schlechte #Hashrate aber langfristiger lohnt es sich für jene Cyberkriminelle unbemerkt weniger Rechenleistung zu 'stehlen' denn binnen weniger Stunden oder Tage von erkannt und von Systemen geworfen zu werden...

📬 Final Cut Pro kostenlos runterladen? Aber bitte ohne Malware!
#Malware #AdobePhotoshop #FinalCutPro #Kryptomining #LogicPro #Mac #macOS #Monero #ThePirateBay #torrent #XMRig #XProtect https://tarnkappe.info/artikel/malware/final-cut-pro-kostenlos-runterladen-aber-bitte-ohne-malware-265921.html

📬 Final Cut Pro kostenlos runterladen? Aber bitte ohne Malware!
#Malware #AdobePhotoshop #FinalCutPro #Kryptomining #LogicPro #Mac #macOS #Monero #ThePirateBay #torrent #XMRig #XProtect https://tarnkappe.info/artikel/malware/final-cut-pro-kostenlos-runterladen-aber-bitte-ohne-malware-265921.html

This article is confusing, as it seems to suggest that shc (shell script compiler) is the malware. shc is legitimate software (although I've never seen it used), it is just being used to obfuscate (and potentially bypass detection) shell scripts that download and install the #XMRig coinminer.

https://asec.ahnlab.com/en/45182/

#Linux #infosec #malware

From a #ThreatIntelligence perspective, the #TTPs would be:

- #T1059.003: Command and Scripting Interpreter: Unix Shell. SHC payloads to be run still need a shell to be identified in the system and that the code inside the payload is, in fact, a shell script.
- #T1027.002: Obfuscated Files or Information: Software Packed with #SHC.
- #T1622: Debugger Evasion by using SHC with '-r'.
- #T1105: Ingress Tool Transfer by downloading payloads from Github.
- #T1496: Resource Hijacking with #XMRig.

From a #ThreatIntelligence perspective, the #TTPs would be:

- #T1059.003: Command and Scripting Interpreter: Unix Shell. SHC payloads to be run still need a shell to be identified in the system and that the code inside the payload is, in fact, a shell script.
- #T1027.002: Obfuscated Files or Information: Software Packed with #SHC.
- #T1622: Debugger Evasion by using SHC with '-r'.
- #T1105: Ingress Tool Transfer by downloading payloads from Github.
- #T1496: Resource Hijacking with #XMRig.

Yesterday CISA and the FBI published a joint advisory on an Iranian #APT compromising FCEB (Federal Civilian Executive Branch) systems. The threat actors exploited #Log4Shell in an unpatched VMware Horizon server, installed #XMRig crypto mining software, moved laterally to the DC, compromised credentials with #Mimikatz, and then backdoored with #Ngrok on several hosts to maintain persistence.

My question is, why the hell they would go out of their way to install XMRig as part of this attack? Was it,

• for Lulz?
• to obfuscate their intent?
• financial motive?

From what I know, "for the Lulz" really isn't part of the APT playbook, and the only APT with financial motive that I'm ware of is North Korea, where cybercrime is literally part of their GNI (Gross National Income). My guess is to obfuscate, but I'd love to hear other people's thoughts on this.

#CTI #DFIR

Yesterday CISA and the FBI published a joint advisory on an Iranian #APT compromising FCEB (Federal Civilian Executive Branch) systems. The threat actors exploited #Log4Shell in an unpatched VMware Horizon server, installed #XMRig crypto mining software, moved laterally to the DC, compromised credentials with #Mimikatz, and then backdoored with #Ngrok on several hosts to maintain persistence.

My question is, why the hell they would go out of their way to install XMRig as part of this attack? Was it,

• for Lulz?
• to obfuscate their intent?
• financial motive?

From what I know, "for the Lulz" really isn't part of the APT playbook, and the only APT with financial motive that I'm ware of is North Korea, where cybercrime is literally part of their GNI (Gross National Income). My guess is to obfuscate, but I'd love to hear other people's thoughts on this.

#CTI #DFIR

#CISA released an Alert today regarding Iranian Government-Sponsored APT actors
+ exploiting #Log4Shell
+ dropping #XMRig crypto miner
+ leveraging #Ngrok for persistence
#threatintel #infosec

https://us-cert.cisa.gov/ncas/alerts/aa22-320a

#CISA released an Alert today regarding Iranian Government-Sponsored APT actors
+ exploiting #Log4Shell
+ dropping #XMRig crypto miner
+ leveraging #Ngrok for persistence
#threatintel #infosec

https://us-cert.cisa.gov/ncas/alerts/aa22-320a

📬 Mining eines XMR Coins kostet Hacking-Opfer 11.000 US-Dollar
#Hacking #Kryptowährungen #Malware #CloudServer #Kryptomining #Monero #Sysdig #TeamTNT #XMR #XMRig https://tarnkappe.info/artikel/hacking/mining-eines-xmr-coins-kostet-hacking-opfer-11-000-us-dollar-256942.html

📬 Shikitega Malware verteilt Monero-Miner auf Linux-Geräte
#Malware #IoTGeräte #KryptoMining #LinuxMalware #LinuxServer #Mettle #MoneroMining #XMRig https://tarnkappe.info/artikel/malware/shikitega-malware-verteilt-monero-miner-auf-linux-geraete-255362.html