This campaign uses SEO poisoning and manipulated AI chatbot results to lure users into downloading fake hardware-monitoring tools. The trojanized installers carry a malicious DLL that sideloads into a legitimate application and quietly deploys ScreenConnect. Attackers then use ScreenConnect to launch a custom RunPE dropper that hollows out Microsoft-signed .NET binaries and injects the -stage payload. The final stage downloads GPU mining tools such as gminer , lolMiner , and SRBMiner-MULTI , then maintains persistence through scheduled tasks, registry Run keys, and a startup shortcut. The malware also adds Windows Defender exclusions to reduce the chance of detection.
Microsoft Defender researchers mapped the full infection chain, including the DLL sideloading method, abuse of ScreenConnect as a remote management tool, and use of a custom RunPE loader named SimpleRunPE.exe . Analysts recovered the ScreenConnect command-line arguments, identified the list of signed .NET binaries used for process hollowing, and documented a command-and-control endpoint protected with a pinned TLS certificate. The investigation also uncovered supporting infrastructure such as malicious domains, IP addresses, and DNS provider details linked to the campaign.
Defenders should enable cloud-delivered protection, enforce attack surface reduction rules, block executable files that do not meet reputation, prevalence, or age requirements, and turn on web and network protection in Microsoft Defender for Endpoint. Remote management tools such as ScreenConnect should be disabled where unnecessary or tightly controlled where required, with monitoring for unauthorized scheduled tasks and suspicious registry Run entries. Any Windows Defender exclusions added by the malware should be removed immediately, and the identified malicious domains and IP addresses should be blocked.
If RuntimeHost.exe or SimpleRunPE.exe is found running from hidden cache directories, isolate the affected host at once, terminate the related ScreenConnect session, and remove all persistence mechanisms, including scheduled tasks, Run keys, and startup shortcuts. Block the domain minemine.gleeze.com and the observed IP addresses, then hunt across the environment for the listed miner binaries and autorun.dll . Finally, restore Defender protections and review exclusion settings for any unauthorized changes.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An attacker has already delivered a hollowed legitimate binary onto the victim machine. The binary now initiates a persistent C2 channel over a WebSocket connection to wss://minemine.gleeze.com:8443/ws . To emulate this, we use a PowerShell script that creates a .NET ClientWebSocket , optionally sets a custom TLS certificate validation callback (simulating certificate pinning), and maintains the connection for a brief period.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
