Stealthy Crypto-Mining Malware Jumps Air-Gaps, Spreads via External Drives

Cybersecurity: Cryptojacking Threat Analysis

Cryptojacking involves the unauthorized use of computing resources to mine cryptocurrency. This activity has evolved from simple browser-based scripts to sophisticated system-level threats utilizing advanced malware techniques.

The infection typically begins with cracked software, where users execute a seemingly legitimate installer. This installer contains a dropper that deploys a controller binary, named Explorer.exe, which manages installation, persistence, mining, and cleanup processes.

Explorer.exe operates as a state machine, driven by command-line parameters, enabling it to function as an installer, watchdog, payload manager, and kill-switch executor. The malware's modes are identified by anime-inspired flags like "002 Re:0" for active infection, "016" for maintenance, and "barusu" for cleanup.

This campaign employs social engineering, propagation over removable media, and a Bring Your Own Vulnerable Driver (BYOVD) technique to maximize hashrate while complicating removal efforts. A built-in time bomb checks against a hardcoded deadline of Mon, Dec 23, 2025, indicating a finite operational window.

Explorer.exe carries its toolkit within its PE resource section, which is decrypted and decompressed into multiple files, including a fake "Microsoft Compatibility Telemetry.exe" miner wrapper and a vulnerable WinRing0x64.sys driver. These files are concealed under user-profile paths with hidden/system attributes to evade detection.

The malware employs a watchdog topology, with components like edge.exe and wps.exe capable of resurrecting each other if terminated. In case of persistent interference, the malware may terminate the Windows shell to re-establish execution during restart.

A worm module listens for device-change notifications to detect new removable drives, copying the explorer.exe payload and disguising it to trick users into executing it on new hosts.

To enhance mining efficiency, the malware uses WinRing0x64.sys driver, allowing unprivileged processes to modify CPU registers, optimizing the CPU cache behavior for the RandomX algorithm used by Monero.

Compromised nodes are directed to the Kryptex mining pool, which supports fiat and Bitcoin payouts. The malware uses ShellExecuteExW for process initiation.

Prevention measures include hardened device-control policies for USB media, block rules for vulnerable drivers like WinRing0x64.sys, and monitoring for disguised telemetry processes. At the time of analysis, a single active worker was noted with activity beginning on Mon, Dec 8, 2025.

This campaign illustrates that cryptojacking now involves comprehensive intrusion tactics, including social engineering, media propagation, persistence, UI spoofing, and kernel-level optimization via vulnerable drivers.

Based on reporting by GBHackers.