🧰 XMRig

The items that name it 10

• Plex vulnerabilities being exploited in the wild to drop a cryptominer
  writeupas classification.technologies2026-10-19
• Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
  articleas classification.technologies2026-10-19
• Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
  articleas tools2026-10-09

  Cryptocurrency mining malware deployed by attackers, disguised as Microsoft Edge

• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
  writeupas tools2026-10-08

  Legitimate open-source Monero cryptocurrency miner; abused by attackers (renamed edge.exe) to mine Monero on compromised hosts.

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeupas tools2026-09-03It is written here as XMRig (renamed SearchIndex.exe).

  Cryptocurrency miner deployed in the 011 payload branch.

• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  articleas tools2026-08-26

  Cryptocurrency mining software deployed by attackers on compromised LiteLLM and Kestra hosts

• Threat Actors Achieve Persistence After SQL Injection
  writeupas tools2026-07-13

  Cryptocurrency mining malware deployed on the compromised endpoint (as xmr-1.zip).

• Untangling a Linux Incident With an OpenAI Twist (Part 2)
  writeupas tools2026-04-22

  Cryptomining malware; Actor B's variant named fkkkf connected to pool.supportxmr[.]com:3333

• The Evolving Linux Threat Landscape
  articleas classification.technologies2026-03-03
• PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182
  writeupas tools2025-12-10

  Cryptocurrency (Monero) mining software, version 6.24.0, deployed by threat actors from official GitHub releases.