Cryptocurrency boom fuels miner malware surge

Cybercriminals increasingly deploy cryptocurrency miners via malware droppers, with monthly detections rising from near-zero to 1,200 samples as Bitcoin surged in 2017.

The 2017 cryptocurrency boom, which saw Bitcoin rise from $1,000 to over $18,000, created lucrative opportunities for cybercriminals beyond traditional ransomware and DDoS extortion. Abuse.ch observed a dramatic surge in cryptocurrency mining malware starting in July 2017, with monthly detections climbing from nearly zero to 1,200 samples by year-end. These coinminers, including families like noobLoader.net and XMRig, are typically delivered through established malware droppers such as Neutrino and Smoke Loader.

Unlike banking trojans, coinminers primarily cause system slowdowns due to intensive CPU usage for mining operations. However, the delivery mechanism poses additional risks — victims often receive multiple malware families simultaneously, including banking trojans like Citadel and Gozi alongside miners. Threat actors who mined cryptocurrencies between September and November 2017 could have more than doubled their profits by December.

The cryptocurrency surge also drove an increase in spam campaigns promoting suspicious trading platforms, particularly targeting Swiss recipients. These campaigns use snowshoe spam techniques across entire /24 IP ranges, often from South African hosting providers, directing victims to sites potentially involved in pyramid schemes or outright fraud.

title: XMRig-style CPU Coinminer Command-Line Execution
id: adf5b9ae-7f4f-5d6b-bf98-f03952864c50
status: experimental
description: Detects command-line arguments characteristic of XMRig and similar CPU
  coinminers (pool/wallet/donate-level/cpu-priority flags), often dropped by loaders
  such as Neutrino or Smoke Loader.
logsource:
  category: process_creation
  product: windows
detection:
  selection_flags:
    CommandLine|contains:
    - --donate-level
    - --cpu-priority
    - --cpu-max-threads-hint
    - -o stratum+tcp
    - --url=stratum+tcp
  selection_wallet:
    CommandLine|re: (-u |--user=)[A-Za-z0-9]{20,}
  condition: selection_flags or selection_wallet
falsepositives:
- Legitimate mining software knowingly run by users or administrators for authorized
  crypto mining
- Security researchers testing miner samples in sandboxes
level: high
tags:
- attack.t1496
- attack.impact
author: Vorant

title: Coinminer or Loader Payload Dropped and Executed from User Temp Directory
id: 65fcd3a9-5057-507e-8ee2-85a4f8c07560
status: experimental
description: Detects execution of an executable from a user temp/appdata location
  where the parent process is a common document/archive handler or script host, consistent
  with victims opening malicious attachments or links that drop coinminers and secondary
  payloads.
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
    - \AppData\Local\Temp\
    - \AppData\Roaming\
    - \Users\Public\
  selection_parent:
    ParentImage|endswith:
    - \winword.exe
    - \excel.exe
    - \wscript.exe
    - \cscript.exe
    - \powershell.exe
    - \explorer.exe
    - \iexplore.exe
  filter_common:
    Image|endswith:
    - \setup.exe
    - \updater.exe
  condition: selection_path and selection_parent and not filter_common
falsepositives:
- Legitimate software installers or auto-update routines writing to temp/appdata and
  launching from there
- Office add-ins or macros used for approved business automation
level: medium
tags:
- attack.t1204.002
- attack.execution
author: Vorant

title: Outbound Connection to Common Cryptomining Pool Ports
id: 680e2c9e-a170-5b12-bca1-1097d231ea87
status: experimental
description: Detects outbound connections from endpoint processes to TCP ports frequently
  used by cryptocurrency mining pools (stratum protocol), which is a strong indicator
  of coinminer malware such as XMRig communicating with its pool.
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
    - 3333
    - 5555
    - 7777
    - 14444
    - 4444
    - 9999
    Initiated: 'true'
  filter_browsers:
    Image|endswith:
    - \chrome.exe
    - \firefox.exe
    - \msedge.exe
  condition: selection and not filter_browsers
falsepositives:
- Legitimate self-hosted or authorized mining operations using the same standard stratum
  ports
- Internal test or development services reusing these ports for unrelated protocols
level: medium
tags:
- attack.t1496
- attack.impact
author: Vorant

Source reporting: https://abuse.ch/blog/cybercriminals-taking-advantage-of-cryptocurrency-boom