{"id":53061,"date":"2025-02-19T04:53:49","date_gmt":"2025-02-19T09:53:49","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=53061"},"modified":"2025-02-19T04:53:49","modified_gmt":"2025-02-19T09:53:49","slug":"miner-xmrig-delivered-via-torrents","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/miner-xmrig-delivered-via-torrents\/53061\/","title":{"rendered":"XMRig miner as a New Year’s gift"},"content":{"rendered":"

From December 31, 2024, our telemetry began detecting a significant surge in the activity of the XMRig cryptominer. While most of the malware launches were detected by home security solutions, some were found on corporate systems. A thorough investigation revealed that cybercriminals had been distributing the malware through game torrents. The attack likely targeted gamers in various countries, including Russia, Brazil, and Germany. However, the cryptominer also surfaced on corporate networks \u2014 probably due to employees using work computers for personal use.<\/p>\n

Malicious campaign <\/strong><\/h2>\n

The campaign, affectionately named StaryDobry (\u201cthe good old one\u201d in Russian) by our analysts, was carefully planned: malicious distributions were created and uploaded to torrent sites between September and December 2024. Of course, the infected games were repacks<\/a> \u2014 modified versions designed to bypass authenticity checks (in other words, cracked).<\/p>\n

Users began downloading and installing these trojanized games, and for a while, the malware showed no signs of activity. But then, on December 31, it received a command from the attackers\u2019 remote server, triggering the download and execution of the miner on infected devices. The list of trojanized titles included popular sim games such as Garry\u2019s Mod, BeamNG.Drive, and Universe Sandbox.<\/p>\n

We closely examined a sample of the malware and discovered the following:<\/p>\n