Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Malicious RubyGems Wait Five Hours and Detect Sandboxes Before Starting Monero Mining
Malware Families
Excerpt
Security researchers Moe Ghasemisharif, Ruian Duan, Zhanhao Chen, and Daiping Liu have uncovered a RubyGems cryptojacking campaign that distributed trojanized copies of popular Ruby libraries. The malicious packages delay execution for five hours, check for sandboxed environments, and then deploy the XMRig miner to secretly mine Monero on compromised systems. The campaign involves at least two publisher accounts, Prvaz12_mars and monib110, which used similar package names but…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | de.monero.herominers.com | High | Score 58/100 | First seen |
| Domain | moneroocean.stream | High | Score 58/100 | First seen |
| Domain | pool.supportxmr.com | High | Score 58/100 | First seen |
| Domain | p2pool.io | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…