Executive Summary
Since at least 2022, a cybercrime campaign has targeted users of illegal streaming and digital library sites, reaching an estimated audience of up to 40 million monthly visits. The attackers deliver malware via ZIP archives disguised as plugin updates or browser patches. Once executed, the infection chain deploys a sophisticated cryptomining operation alongside a Remote Access Trojan (RAT) for further command execution.
The technical workflow utilizes a modified fork of the open-source SilentCryptoMiner project. It features advanced evasion techniques including DLL side-loading, stack-smashing shellcode, DNS tunneling for initial validation, and multi-component persistence through a 'Watchdog' module. The campaign is notable for its persistence, having distributed unmodified versions of its core DLL for over a year while rotating C2 domains based on date-generated algorithms.
Impact is primarily focused on resource exhaustion and unauthorized remote control of compromised Windows systems. While currently focused on cryptocurrency mining, the integrated RAT capabilities allow the threat actor to execute arbitrary commands, shellcode, or additional PE files, posing a broader long-term risk to infected hosts.