Vilen Kamalov

Oct 26, 2023 | securelist.com | Sergey Belov |Vilen Kamalov |Sergey Lozhkin |Vasily Kolesnikov

IntroductionIt’s just another cryptocurrency miner… Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows. It comes equipped with a built-in TOR network tunnel for communication with command servers, along with update and delivery functionality through trusted services such as GitLab, GitHub, and Bitbucket, all using custom encrypted archives.