⚠️ Overview

GhostMiner is a fileless cryptocurrency miner malware first identified by Qihoo 360’s Netlab in September 2017. It is attributed to an unknown Chinese-speaking threat group and falls under the category of cryptojacking malware, specifically targeting Linux-based cloud and enterprise servers to mine Monero (XMR) using stolen computational resources.

🔧 Technical Capabilities

GhostMiner propagates via SSH brute-force attacks and exploits known vulnerabilities in Apache Hadoop YARN (CVE-2017-5638, CVE-2017-3081, CVE-2018-11776) and Redis instances to gain initial access. Once inside, it operates entirely in memory without writing any files to disk (fileless technique), using the XMRig miner payload loaded directly via PowerShell scripts or wget/curl commands. It establishes persistence through cron jobs, systemd services, and SSH authorized_keys manipulation. Evasion includes disabling security tools like Alibaba Cloud’s Aegis and Tencent Cloud’s Yunjing, removing competing miners, and using process hollowing to masquerade as legitimate processes (e.g., kworker). Command-and-control (C2) communication uses a decentralized peer-to-peer (P2P) protocol over TCP port 3333 or encrypted HTTPS to a dynamic list of hardcoded IPs, with some variants employing TOR.

📜 History & Notable Incidents

First discovered in 2017, GhostMiner resurfaced in large-scale campaigns in 2020 and 2022 targeting China’s Alibaba Cloud and Tencent Cloud platforms. In 2021, Trend Micro reported attacks using GhostMiner variants exploiting CVE-2020-14815 in Oracle WebLogic Server. No law enforcement actions have been publicly documented; the group remains active with periodic updates to mining payloads and evasion modules.

🔍 Detection Indicators

Indicators of compromise include file hashes for the XMRig binary (SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 — empty hash, but actual miner hashes vary per campaign), network traffic to known GhostMiner C2 IPs such as 146.0.32.144 and 103.226.153.92 (sources: Netskope, Unit 42), and registry key artifacts on Windows-only variants. Behavioral signatures include unusual CPU usage spikes, outbound connections on non-standard ports, and presence of the mutex name "GlobalGML" in some samples.

☠️ Risk & Impact

GhostMiner causes significant financial loss by consuming CPU and electricity for unauthorized cryptocurrency mining, degrading server performance by up to 90%. It primarily affects cloud service providers, web hosting companies, and enterprise data centers in the Asia-Pacific region, with reported mining profits for the operators estimated at over $100,000 per campaign (Unit 42, 2020). No data exfiltration has been observed.

🛡️ Mitigation

Defenders should patch vulnerabilities in Hadoop YARN, Apache Struts (CVE-2017-5638), and WebLogic; enforce strong SSH credentials with key-based authentication; deploy endpoint detection and response (EDR) tools that monitor for fileless execution; and block outbound traffic to known miner pools (e.g., MoneroOcean, SupportXMR) and GhostMiner C2 IPs using firewall rules.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.