A miner with a side of RAT: the unintended gift with your TV show or book
Essential information
- Published
- 28/05/2026 12:56
- Modified
- 28/05/2026 15:34
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- cryptocurrency miner dll side-loading dns tunneling domain generation algorithm fake updates piracy sites silentcryptominer xmrig
- Tags
- 2026-05-28 cryptocurrency miner dll side-loading dns tunneling domain generation algorithm fake updates piracy sites silentcryptominer xmrig
- Related entities
- 7 indicators, 7 observables, 21 techniques (mitre), 2 malware, 7 others
Description
A cybercrime campaign active since at least 2022 has been distributing cryptocurrency miners and RAT malware through illegal streaming sites and digital libraries. Victims are tricked via fake video player plugin updates or browser crash pages into downloading ZIP archives containing legitimate executables and malicious DLLs. The malware employs DLL side-loading, establishes persistence through Windows services, and deploys multiple components including XMRig-based CPU miners, GPU miners, a watchdog module, and a RAT agent with remote control capabilities. The campaign leverages highly popular pirated content sites with monthly traffic reaching up to 40 million visits, significantly expanding the potential victim pool. The malware includes sophisticated anti-detection features, DNS tunneling for command-and-control, and domain generation algorithms based on dates.