Huntress Traces XMRig Mining Infections to TeamViewer Access
Summary
Huntress traced XMRig infections on multiple endpoints to TeamViewer access, followed by PowerShell scripts that downloaded and installed the miner. The team alerted affected customers and added detections.
Key points
- Huntress analysts identified XMRig miners on endpoints at multiple customer organizations.
- TeamViewer incoming-connection logs correlated with malicious activity showed TeamViewer was the initial access method; Huntress said the credentials were likely compromised but could not determine how.
- PowerShell downloaded and ran a batch file that installed the miner, while a Windows service provided persistence.
- Investigators reconstructed activity using EDR telemetry, PowerShell event logs, and TeamViewer access logs; they found no file transfers in the TeamViewer logs.
- Huntress developed an EQL detection correlating TeamViewer_Desktop.exe with clip.exe, which alerted on several later endpoints and was reported as high fidelity.
- The team notified affected customers and recommended removing the miner.
Article Details
- Attack Vectors
- Threat actors used TeamViewer to gain access to endpoints, then used PowerShell to download and run a batch file that installed the XMRig cryptocurrency miner.
- The article reports that the TeamViewer credentials were likely compromised, but Huntress could not determine how they were compromised.
- Defensive Notes
- Huntress recommended removing the miner from impacted endpoints and notified customers that their TeamViewer credentials were likely compromised.
- Review TeamViewer incoming connection logs and correlate access with endpoint activity, including PowerShell and clip.exe execution.
- Huntress developed an EQL detection for TeamViewer_Desktop.exe followed by clip.exe within seven minutes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//c3poolbat[.]oss-accelerate[.]aliyuncs[.]com/autoc3pool.bat | URL used to download the batch file that installed the XMRig miner. |
| URL | hxxp[:]//follow247[.]xyz/ViewXmrig | URL used in prior activity to download the XMRig miner. |
| URL | hxxps[:]//github[.]com/xmrig/xmrig/releases/latest | Specific GitHub release URL reported as a source from which the XMRig miner was downloaded. |
MITRE ATT&CK
T1059.001 · PowerShellPowerShell scripts downloaded the batch file and performed subsequent activity on the endpoints.T1059.003 · Windows Command ShellThe downloaded batch file was launched with a wallet address as its argument.T1071.001 · Web ProtocolsPowerShell used HTTP/HTTPS URLs to download the batch file and miner.T1115 · Clipboard DataAnalysts observed clip.exe near the initial PowerShell command and assessed that the clipboard was likely used to transfer the command to the endpoint.T1496 · Resource HijackingXMRig was installed to mine cryptocurrency on infected endpoints.T1543.003 · Windows ServiceA Windows service was created to keep the miner persistent on an endpoint.