🕵️ XMRig

The items that name it 11

• Plex vulnerabilities being exploited in the wild to drop a cryptominer
  writeup2026-10-19It is written here as xmrig: cryptominer dropped in the attacks.
• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
  writeup2026-10-08

  Legitimate open-source Monero miner, deployed by the threat actors (renamed as edge.exe/msedge.exe) to covertly mine cryptocurrency on compromised AhsayCBS hosts.

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeup2026-09-03

  Cryptocurrency miner malware deployed as part of the 011 state payload branch, renamed as SearchIndex.exe.

• Inside 90 days of attacks on AI infrastructure
  writeup2026-08-27

  Cryptominer deployed after successful blind prompt injection sessions against Node-RED, staged at /usr/src/node-red/xmrig to blend with the Node.js process tree; also staged on a Langflow honeypot at /app/data/.claude/ renamed to 'unicorn' to blend in with Claude Code's config directory.

• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  article2026-08-26

  Cryptocurrency mining malware (XMRig or XMRig-like components) deployed in both the LiteLLM and Kestra compromises, with RandomX-related CPU tuning via MSR module write access

• Socket: Operation Muck and Load
  writeup2026-07-16

  Monero cryptominer related to BitMiner, identified among confirmed malware files in the GitHub repository cluster.

• Threat Actors Achieve Persistence After SQL Injection
  writeup2026-07-13

  Cryptocurrency mining malware downloaded to the endpoint as xmr-1.zip and given persistence via nssm.exe.

• Orca Security: Langflow RCE (CVE-2026-33017) Actively Exploited
  advisory2026-07-02

  Monero cryptominer deployed by the lambsys binary, customized with geo-aware pool selection.

• The Evolving Linux Threat Landscape
  article2026-03-03

  Open-source cryptominer tool used to mine Monero (XMR), attempted to be installed after PeerBlight in an observed attack

• PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182
  writeup2025-12-10

  Cryptocurrency mining software, version 6.24.0, pulled directly from official GitHub releases and deployed via scripts like sex.sh and the base64-encoded script in Case #5; configured to connect to pool.hashvault[.]pro using a hardcoded Monero wallet address.

• deepfence/YaraHunter
  repo

  Cryptominer software often installed through an exploit; used in the page's example scan of the metal3d/xmrig image as an indicator of compromise.