A sophisticated, financially motivated cryptojacking campaign is successfully bypassing EDR and AV protections by blending AI-driven social engineering with Living-off-the-Land (LotL) techniques. By abusing ScreenConnect for persistence and Microsoft .NET utilities for execution, threat actors are hijacking high-performance GPU resources to maximize cryptocurrency mining profits.

• Incident Overview: Sophisticated Resource Hijacking

  • Target Profile: The campaign specifically targets high-performance computing environments, including workstations used by gamers, engineers, and creative professionals.
  • Primary Objective: Unauthorized utilization of high-end GPU hardware to conduct large-scale, profitable cryptocurrency mining operations.
  • Threat Actor Motivation: Highly organized, financially motivated actors focused on maximizing "hash rate" per infected node through hardware-optimized payloads.
  • Threat Landscape: This represents a shift toward "silent" cryptojacking that prioritizes long-term, low-visibility persistence over immediate disruption.

• Attack Vector: AI Manipulation and SEO Poisoning

  • Initial Access via SEO: Attackers utilize SEO poisoning to hijack high-intent search queries, redirecting users from legitimate software or driver searches to malicious landing pages.
  • AI Chatbot Exploitation: Sophisticated manipulation of Large Language Model (LLM) responses is used to provide malicious URLs as "recommended" resources to unsuspecting users.
  • Malicious Landing Pages: Users are lured through perceived legitimacy in search engines or AI-generated answers to sites hosting initial access payloads.
  • Social Engineering Synergy: The combination of AI-driven information and poisoned search results creates a highly convincing deceptive environment for end-users.

• Persistence and Access: Abuse of ScreenConnect

  • Tool Misuse: Threat actors deploy ScreenConnect (ConnectWise Control) to establish a reliable, legitimate-looking remote access channel.
  • Persistence Mechanism: The installation of ScreenConnect provides the attackers with stable, unauthorized remote access sessions that mimic standard IT administrative activity.
  • Infrastructure Utilization: Compromised endpoints communicate with dedicated C2 (Command and Control) infrastructure to receive instructions and manage the mining botnet.
  • Detection Avoidance: By using a well-known remote management tool, attackers minimize the likelihood of triggering alerts associated with custom, unrecognized backdoors.

• Execution and Evasion: Living-off-the-Land via .NET

  • .NET Utility Abuse: Attackers leverage legitimate Microsoft .NET binaries, specifically MSBuild and csc.exe, to execute malicious code within a trusted context.
  • Evasion via LotL: Using these built-in Windows utilities allows the campaign to bypass traditional signature-based EDR/AV solutions by masquerading as standard system processes.
  • Advanced Obfuscation: The campaign utilizes obfuscated .NET assemblies and complex PowerShell staging scripts to hide the true intent of the execution chain.
  • Memory-Resident Execution: The use of these utilities facilitates the execution of malicious logic that avoids writing unverified files directly to the disk.

• Payload and Resource Impact: GPU-Centric Mining

  • Specialized Payloads: The final stage involves the deployment of optimized GPU cryptominer binaries, such as XMRig or its variants, specifically tuned for high-performance hardware.
  • Hardware Targeting: Attackers actively profile systems to identify high-end GPU models, ensuring the mining operation yields maximum profitability.
  • System Performance Degradation: Affected hosts experience significant performance drops and thermal increases, directly impacting the productivity of professional workstations.
  • Economic Extraction: The campaign's success is measured by the volume of cryptocurrency generated via stolen computational cycles and the associated wallet addresses.

• Defensive Actions and Indicators of Compromise (IoCs)

  • Behavioral Monitoring: Security teams should prioritize monitoring for anomalous child processes originating from MSBuild.exe or csc.exe, especially those initiating network connections.
  • ScreenConnect Auditing: Implement strict monitoring for unauthorized ScreenConnect installations and audit all remote access session logs for unusual activity or off-hours connections.
  • Network Intelligence: Monitor for communication with known C2 domains and IPs associated with cryptomining pools and the specific threat actor infrastructure.
  • Endpoint Hardening: Enforce strict application control policies to limit the execution of unauthorized .NET assemblies and restrict the use of administrative utilities by non-privileged users.