{"id":46,"date":"2026-02-26T05:09:50","date_gmt":"2026-02-26T05:09:50","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=46"},"modified":"2026-02-26T05:09:50","modified_gmt":"2026-02-26T05:09:50","slug":"wormable-xmrig-campaign-uses-byovd-exploit-and-time-based-logic-bomb","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=46","title":{"rendered":"Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner program on compromised hosts.<\/p>\n

\u00abAnalysis of the recovered dropper, persistence triggers, and mining payload reveals a sophisticated, multi-stage infection prioritizing maximum cryptocurrency mining hashrate, often destabilizing the victim system,\u00bb Trellix researcher Aswath A said<\/a> in a technical report published last week.<\/p>\n

\u00abFurthermore, the malware exhibits worm-like capabilities, spreading across external storage devices, enabling lateral movement even in air-gapped environments.\u00bb<\/p>\n

The entry point of the attack is the use of social engineering decoys, advertising free premium software in the form of pirated software bundles, such as installers for office productivity suites, to trick unsuspecting users into downloading malware-laced executables.<\/p>\n

The binary acts as the central nervous system of the infection, serving different roles as an installer, watchdog, payload manager, and cleaner to oversee different aspects of the attack lifecycle. It features a modular design that separates the monitoring features from the core payloads responsible for cryptocurrency mining, privilege escalation, and persistence if it’s terminated.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

This flexibility, or mode switching, is achieved via command-line arguments –<\/p>\n