This is an automated archive made by the Lemmit Bot.

The original was posted on /r/monero by /u/MoneroFox on 2025-02-19 14:02:53+00:00.

… The StaryDobry campaign used a multi-stage infection chain culminating with an XMRig cryptominer infection. Users downloaded the trojanized game installers from torrent sites, which appeared normal, including the actual game they were promised, plus malicious code … The malware demonstrates highly evasive behavior, terminating immediately if it detects any security tools, possibly to avoid harming the torrent’s reputation … If the host machine has at least eight CPU cores, it downloads and runs an XMRig miner. The XMRig miner used in StaryDobry is a modified version of the Monero miner that constructs its configuration internally before execution and does not access arguments. The miner maintains a separate thread at all times, monitoring for security tools running on the infected machine, and if any process monitoring tools are detected, it shuts itself down. The XMRig used in these attacks connects to private mining servers instead of public pools, making the proceeds harder to trace …