Cybercriminals have begun openly marketing a powerful new variant of the HiddenMiner malware on underground dark web forums, raising alarms within the cybersecurity community.
The malware, a heavily modified Monero (XMR) cryptocurrency miner, attracts buyers due to its advanced stealth capabilities and ease of use, even for less technically skilled threat actors.
HiddenMiner first made headlines several years ago as a notorious malware family targeting Windows users to covertly mine cryptocurrency.
The latest version, now available on popular Russian and English-speaking cybercrime marketplaces, boasts a suite of custom features designed to maximize profits while evading detection.
According to forum advertisements reviewed by security researchers, HiddenMiner offers one-click installation, allowing even novice attackers to deploy it with minimal effort.
The malware features an AntiVM module to evade detection and analysis within virtual machine environments common tactic used by cybersecurity firms for malware sandboxing.
Perhaps most concerning is that HiddenMiner no longer requires administrator privileges to operate.
Its built-in privilege escalation bypass techniques enable it to infect machines without triggering security prompts, drastically increasing its infection potential.
To remain hidden, HiddenMiner deploys a series of rootkit techniques that conceal both its process and installation folders.
This makes manual detection by users or IT administrators nearly impossible. Additionally, the malware aggressively blocks antiviruses, scanners, and other popular security tools, ensuring a longer, uninterrupted mining activity.
HiddenMiner is also designed for persistence, featuring an auto-download mechanism that ensures it launches every time Windows starts.
For buyers, technical support is available for one month post-purchase-an unusual but increasingly common perk in the cybercrime marketplace.
The base price for HiddenMiner ranges from $40 to $100, depending on the selected features.
Optional add-ons are available, including a dual XMR + Ethereum mining extension for an additional $30-a feature aimed at maximizing profitability from infected machines.
Cybersecurity experts warn that this new wave of easily accessible, high-functionality mining malware could lead to a significant rise in crypto-jacking attacks.
The low price and simplicity of use are particularly concerning, as they lower the barrier for entry for would-be cybercriminals.
Organizations are urged to strengthen their endpoint defenses, monitor for anomalous system resource usage, and ensure all software is regularly updated.
As HiddenMiner and similar threats become more sophisticated, vigilance and proactive defense remain the best line of protection against this evolving cyber threat.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…