Reddit • 11w
Multi-Stage Cryptojacking Campaign Exploiting ScreenConnect and Microsoft .NET Utilities
A sophisticated, financially motivated cryptojacking campaign is successfully bypassing EDR and AV protections by blending AI-driven social engineering with Living-off-the-Land (LotL) techniques. By abusing ScreenConnect for persistence and Microsoft .NET utilities for execution, threat actors are hijacking high-performance GPU resources to maximize cryptocurrency mining profits.