Advanced Crypto Mining Malware Spreads Through External Drives and Air-Gapped Systems

[Parkinsond]

Content source

https://cybersecuritynews.com/advanced-crypto-mining-malware/

A sophisticated cryptocurrency mining campaign has emerged, targeting systems through external storage devices with the ability to compromise even air-gapped environments.

The malware operates as a multi-stage infection that prioritizes mining Monero cryptocurrency while establishing persistent mechanisms to resist removal.

Unlike typical cryptojacking operations, this campaign employs kernel-level exploitation and worm-like propagation capabilities.

The attack begins through pirated software bundles masquerading as legitimate office productivity suite installers.

The operation features watchdog processes creating a self-healing architecture where terminating one component triggers others to resurrect it within seconds.

What makes this threat particularly concerning is its propagation method. Trellix analysts identified the campaign in late 2025, uncovering an operation that actively monitors for newly connected external drives.

When users insert USB flash drives or external hard disks, the malware automatically copies itself to the device and creates hidden folders with deceptive shortcuts.

This mechanism enables lateral movement across networks and can breach air-gapped systems through physical media transfer.

The most technically advanced component involves a Bring Your Own Vulnerable Driver technique. The malware drops WinRing0x64.sys, a legitimate but vulnerable driver component containing CVE-2020-14979.

This vulnerability allows gaining Ring 0 kernel privileges, bypassing the operating system’s hardware abstraction layer.

Organizations should enforce Microsoft’s Vulnerable Driver Blocklist through Windows Defender Application Control to prevent vulnerable drivers from loading.

Advanced Crypto Mining Malware Spreads Through External Drives and Air-Gapped Systems

Crypto mining malware spreads via USB, infects air-gapped systems, exploits kernel flaws, and mines Monero persistently.

cybersecuritynews.com

 

[Parkinsond]

Can cryptominer work offline!

 

[Sampei.Nihira]

It is interesting to note that HaGeZi's filter lists incorporate various filter lists against Crypto Mining, and the OISD filter list also has this functionality.

 

[Parkinsond]

It is interesting to note that HaGeZi's filter lists incorporate various filter lists against Crypto Mining, and the OISD filter list also has this functionality.

Using hagezi tif for dns.

 

[Wrecker4923]

This one has a few teasers for me:

1. What's the point of mentioning "air-gapped," even in the original Trellix report? It's more like a multi-staged malware that is fully contained on disk, not needing a network connection for the entire chain. Is the term just used as clickbait?
2. The BYOD WinRing0x64.sys may have been flagged (and removed) by MD since at least March 2025, and this campaign has been detected in late 2025. How did the driver get onto the target systems? Did the users put it on the whitelist?
3. A miner couldn't be air-gapped. Infected air-gapped systems just become a vector. But again, why mention "air-gapped" in the first place?

 

[ForgottenSeer 123960]

Technical Analysis & Remediation

MITRE ATT&CK Mapping

T1091
(Replication Through Removable Media)

T1068
(Exploitation for Privilege Escalation)

T1490
(Resource Hijacking)

T1562.001
(Impair Defenses: Disable or Modify Tools)

CVE Profile
CVE-2020-14979
NVD Score: 7.8
CISA KEV Status: Active

Telemetry

Hashes
bb97dfc3e5fb8109bd154c2b2b2959da (Orchestrator executable).

Executables/Processes
Microsoft Compatbility Telemetry.exe (Miner wrapper)
explorer.exe (Orchestrator)
msedge.exe (Watchdog)
ksomisc.exe (Watchdog)
wpsupdate.exe (Watchdog).

Command Line Arguments
002 Re:0 (Active infection mode)
016 (Maintenance mode)
barusu (Cleanup/Kill switch).

Target Driver
WinRing0x64.sys.

Constraint
The structure resembles a modular state-machine design where process termination triggers immediate resurrection by parallel watchdogs, creating a self-healing architecture.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Enforce strict software inventory policies and security awareness training to eliminate the use of pirated or unverified software bundles.

DETECT (DE) – Monitoring & Analysis

Command
Deploy SIEM hunting queries for anomalous execution of explorer.exe running from non-standard directories or utilizing anomalous command-line parameters like 002 Re:0 or barusu.

Command
Alert on continuous CPU spikes aligning with the RandomX mining algorithm signature.

RESPOND (RS) – Mitigation & Containment

Command
Suspend all identified watchdog processes (msedge.exe, ksomisc.exe, Wpsupdate.exe) simultaneously via EDR to prevent the self-healing resurrection cycle before terminating the primary miner process (Microsoft Compatbility Telemetry.exe).

RECOVER (RC) – Restoration & Trust

Command
Validate system cleanliness by sweeping all connected external storage drives for hidden LNK files and dropped payloads.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Enforce Microsoft's Vulnerable Driver Blocklist via Windows Defender Application Control (WDAC) to prevent the loading of WinRing0x64.sys and mitigate BYOVD exploitation.

Command
Implement Device Control policies to restrict executable payloads from running on removable media and restrict outbound connections to consumer-grade mining pools via web filtering.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Disconnect from the internet immediately to severe connections to mining pools.

Command
Do not log into banking/email until verified clean.

Priority 2: Identity

Command
Reset passwords/MFA using a known clean device (e.g., phone on 5G) in case of secondary infostealer payloads bundled with the pirated software.

Priority 3: Persistence

Command
Check Scheduled Tasks, Startup Folders, and Browser Extensions for any anomalous entries. If infected, back up essential files (verifying no hidden folders/shortcuts are copied) and perform a full system wipe and OS reinstall, as kernel-level exploitation completely compromises the operating system's integrity. Do not plug potentially infected USB drives into clean systems.

Hardening & References

Baseline
CIS Microsoft Windows Desktop Benchmarks (Enable memory integrity/HVCI, restrict removable media execution).

Framework
NIST CSF 2.0 / SP 800-61r3.

Threat Intelligence

Trellix Advanced Research Center

Cyber Security News

 

[Parkinsond]

Did the users put it on the whitelist

User can turn off the blocklist

 

[Wrecker4923]

User can turn off the blocklist

I can understand this for people trying to install pirated software on a particular system. But what about the peripheral systems that the worm-like malware spreaded to? Wouldn't it get detected?