Sunday, July 21, 2024

Biggest Crypto-Mining Campaign Ever – Hackers Mine $3 Million Worth of Monero Crypto-currency

Security researchers from Checkpoint discovered a largest Monero mining activity that uses XMRig miner on various versions of Windows machines.

The hacker group earned more than $3 million worth Monero coins, and now to speed up their mining process they are targeting powerful Jenkins CI server.

Past few year Crypto currency mining is a very easy method for cyber criminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

How Attackers Inject Monero Mining Payloads

To install Monero mining payloads attackers leverage the known vulnerability CVE-2017-1000353 in the Jenkins Java deserialization implementation which accepts any serialized objects.

Attackers exploit the vulnerability by sending multiple successive session requests to CLI Interface.

Researchers said “After the first request, the second request that contains crafted packets will be sent immediately. The First request is to identify the client capabilities and the second one consist of the Monero miner payload”.
Monero mining

The malicious code initiates the hidden PowerShell to run the scripts in the background and downloads final Monero miner payload minerxmr.exe to windows servers. And later on, start command will be executed to start the mining process.

START C:\\Windows\\minerxmr.exe

Researchers said “The operation uses a hybridization of a Remote Access Trojan (RAT) and XMRig miner over the past months to target victims around the globe. The miner is capable of running on many platforms and Windows versions.”

The mining operation is well planned and executed in wild, they used a number of mining-pools to collect payments from victims, but all the funds deposited to only one wallet.As of now $3 million has been mined.

2017 is the year of data breaches and ransomware, now attackers shifted their focus to crypto mining attacks by using victims resources. Starting from the year 2018 a number of Cryptomining Attacks launched to Mine Monero Cryptocurrency.

Last week Attackers hijacked 4275 websites to inject Coinhive Monero miner including the websites of government authorities(, NHS Foundation (, and

More than 500 million computers are mining cryptoCurrency in their browsers without the user’s knowledge and also the chrome extension started mining cryptocurrency.

Also, the Oracle Weblogic vulnerability (CVE 2017-10271) abused to run crypto miners and hijacking their processing power to mine Monero coins makes the spike in CPU usage.


Domain and IP:

  • 222[.]184[.]79[.]11
  • 183[.]136[.]202[.]244
  • btc[.]poolbt[.]com
  • shell[.]poolbt[.]com
  • xmr[.]btgirl[.]com[.]cn
  • btc[.]btgirl[.]com[.]cn


  • 0bb4503cc52530ddadb102fa4010fb4d89af88aca846d4b16f601d0702134246
  • 06f8eda46fd6bdc11b8ec4d18a0f0afbf3d47f82cea8363d342975896582a715
  • f0430130a2f3549b1aeff0a9fb2246f68f585a7c1d312c7be385a1cf5f37e70d
  • c87d294cb0384cb56f4829d58cdd3f53572d3f95c2133a9b1da5f5bc1710f22f
  • f750d6da918a5f2f2c442a339821ffebcad4b61e4ca1684bac0e7df98416a794
  • 3002551eebaf486d77a2b81d87db553ad8632bb132553e306395c5da589171fe
  • 213a23219ff89c412f92aa1fdf7152178a81514014ee1cc4ffee97e725ee63a3
  • ff8c97cd55523cbdceef80407269d35bbf78abcbf807426c12d9debe1ce498d9
  • 2beaa23907c40cfcb705844f4f515ff81a788abe1aed2c8d23626d9d735968ae
  • b22fa98c3ee99222c4e827a9745f206ccf7cd40530459a92f183e148b0df5ce9

Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles