Scworld

USB-based CoinMiner Malware Targets South Korean Workstations

First seen 9 Dec 2025, 01:47 UTC • Socprime

•86% similarity •37.6

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

CoinMiner malware is being spread through USB drives in South Korea, utilizing malicious shortcut files to execute VBS scripts that deploy BAT malware. This attack campaign aims to compromise workstations by establishing Windows Defender exclusion paths and delivering cryptocurrency miners like PrintMiner and XMRig.

ThreatCluster AI How this analysis works

Attack Flow

10 entities, 12 inferred relationships (STIX 2.1).

Technique (5)

Malware
DCOM Launch
T1059.003 - Windows Command Shell
T1059.005 - Visual Basic
T1059 - Command and Scripting Interpreter

Malware (3)

CoinMiner
PrintMiner
XMRig

Affected Platform (2)

Windows
Windows Defender

Relationships

Malware targets Windows
Malware targets Windows Defender
DCOM Launch targets Windows
DCOM Launch targets Windows Defender
T1059.003 - Windows Command Shell targets Windows
T1059.003 - Windows Command Shell targets Windows Defender
T1059.005 - Visual Basic targets Windows
T1059.005 - Visual Basic targets Windows Defender
T1059 - Command and Scripting Interpreter targets Windows
T1059 - Command and Scripting Interpreter targets Windows Defender
CoinMiner related to PrintMiner
CoinMiner related to XMRig

Community

Browse all →

Tracked Entities in This Story

CoinMiner PrintMiner XMRig Windows Windows Defender

USB-based CoinMiner Malware Targets South Korean Workstations

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story