{
  "family": "bitmin",
  "sample_count": 112,
  "category": "trojan",
  "description": "Trojan:Win32/Bitmin is a generic classification for stealthy cryptocurrency mining trojans designed to quietly commandeer endpoint CPU and GPU resources to mine digital currencies (most commonly Monero/XMR) for the attacker.<br><br><b>Understanding Bitmin</b><br>To the end-user, a Bitmin infection manifests as severe system sluggishness, loud cooling fans, and a rapidly draining laptop battery. For incident responders, Bitmin represents a resource theft threat that significantly degrades operational productivity and increases hardware wear. While it does not typically steal data, its presence indicates a failure in perimeter defenses.<br><br><b>Execution and Evasion Strategies</b><br>Bitmin variants are distributed via drive-by downloads, fake software installers, or as secondary payloads dropped by exploit kits. Upon execution, the trojan typically drops a modified, command-line version of the open-source XMRig miner into the <code>%AppData%</code> or <code>%Temp%</code> directory. It establishes persistence via a Scheduled Task or Registry Run key. To evade detection, Bitmin employs resource throttling (e.g., only utilizing 50% of the CPU so the user doesn't notice) or pausing the mining operation entirely if it detects Task Manager or a popular PC game being launched.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is endpoint performance degradation. Threat hunters should investigate EDR alerts for 'High CPU Utilization by Unknown Process'. Network logs will show continuous, low-bandwidth outbound connections to known mining pools (using the Stratum protocol) over non-standard ports (e.g., 3333, 4444). Analysts should look for processes executing from user directories with long command-line arguments specifying wallet addresses and pool URLs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1496",
    "T1053.005",
    "T1105",
    "T1562.001",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactic": "Impact"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network; this immediately severs the connection to the mining pool, rendering the attacker's operation unprofitable.",
    "Utilize EDR to identify and terminate the process aggressively consuming CPU cycles, paying close attention to hidden or injected processes.",
    "Audit the Windows Task Scheduler and Registry Run keys to remove the persistence mechanisms responsible for launching the miner.",
    "Block the identified mining pool IP addresses and domains at the corporate firewall to prevent future infections from communicating outward."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as 'just a miner'; the initial vector that delivered the miner must be identified, as it could just as easily deliver ransomware.",
    "Avoid relying solely on Task Manager to find the process; advanced miners will suspend execution when Task Manager is opened."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}