Darktrace Discovers Sneaky Crypto Miners that Outwit Windows Defender – Who Knew? 😱💻

by

In the wild world of cyber-shenanigans, Darktrace, the cybersecurity equivalent of a really overenthusiastic security guard, has uncovered a new cryptojacking campaign. And surprise! It manages to dodge Windows Defender like a ninja in the night, all the while secretly adding to the global crypto treasure chest. Who needs pirates when you have malware? 🏴‍☠️💰

Cryptojacking Illustration

a cryptojacking scheme targeting Windows systems, because hackers love comfort zones.

  • The campaign uses a rather sneaky set of tools-mainly NBminer-to mine cryptocurrencies while the user is blissfully unaware.

    • First spotted in late July (because hackers have impeccable timing), this multi-stage infection chain is sort of like a digital game of hide and seek. The malware hijacks your computer’s processing power to mine crypto coins without asking politely, according to the ever-wise Darktrace researchers Keanna Grelicha and Tara Gould, who might now be considering a new career in comedy as well.

    They discovered that the malicious actors exploit PowerShell-Microsoft’s built-in scripting language-turning a tool meant for IT professionals into their personal puppet master. The scripts run directly in your RAM (because who needs hard drives, right?) making it harder for the traditional antivirus to notice anything suspicious-kind of like hiding in plain sight, but without a trench coat.

    Then, these clever hackers turn to AutoIt, a Windows automation tool that’s usually used to simplify boring tasks-now recycled into an evil loader. This malicious loader performs a few tricks: it checks if your environment is a sandbox (spoiler: it’s probably not), looks for existing antivirus tools, and tries to outsmart Windows Defender. If your user account isn’t a king or queen-meaning you lack administrative power-they attempt a User Account Control (UAC) bypass, because why ask nicely when you can just hijack?

    If these conditions are met-because apparently hackers enjoy playing by the rules-they download and run NBMiner, a popular crypto-mining contraption that uses your GPU to churn out Ravencoin (RVN) and Monero (XMR), making your computer the unwitting producer of digital gold. All this while you’re left wondering, “What did I do to deserve this?” 🧐

    it targeted both Windows and macOS systems, because why pick just one platform when you can spread chaos equally across the digital universe?

    Social Engineering Illustration

    And so, dear readers, if your computer is mining cryptocurrencies without your permission, don’t be surprised-those clever cyber-ninja hackers are watching and waiting, ready to turn your device into their personal gold mine. Or so they hope. 😉

    Read More

    2025-09-03 16:59