A new malware campaign is spreading the SilentCryptoMiner cryptocurrency miner by disguising it as a tool for bypassing internet restrictions.
Russian cybersecurity firm Kaspersky reports that cybercriminals are increasingly using Windows Packet Divert (WPD) tools to distribute malware under the pretense of restriction-bypass programs. These malicious tools are often distributed as archives containing installation instructions that advise users to disable security software, allowing the malware to persist undetected.
This tactic has been used to spread stealers, remote access trojans (RATs), and cryptocurrency miners such as NJRat, XWorm, Phemedrone, and DCRat. The latest wave of attacks has compromised over 2,000 Russian users, distributing the miner through links shared via a YouTube channel with 60,000 subscribers.
In an evolution of this method, attackers have begun impersonating developers of legitimate tools, threatening YouTube channel owners with fake copyright strikes. They demand that the victims post videos with malicious links or face channel takedowns for alleged infringement. In December 2024, reports emerged of minor-infected versions of these tools being spread through Telegram and YouTube channels, which were later shut down.
The malware is concealed within booby-trapped archives that include an extra executable. A legitimate batch script is modified to execute the malicious binary via PowerShell. If an antivirus program detects and deletes the malware, the victim sees an error message instructing them to disable security protections and re-download the file.
The malware is delivered in two stages:
- A Python-based loader downloads and executes a second-stage Python script.
- This script retrieves the SilentCryptoMiner payload, ensures persistence, checks for sandbox environments, and configures Windows Defender exclusions.
The miner, built on the open-source XMRig, is padded with random data to increase its size to 690 MB, making it harder for antivirus tools to analyze. It uses process hollowing to inject mining code into the dwm.exe system process and can pause mining if certain processes are detected. The malware can also be controlled remotely via a web panel.
Image Credit : Tripwire
Comments