Scworld

USB-based CoinMiner Malware Targets South Korean Workstations

First seen 9 Dec 2025, 01:47 UTC • •37.6

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

CoinMiner malware is being spread through USB drives in South Korea, utilizing malicious shortcut files to execute VBS scripts that deploy BAT malware. This attack campaign aims to compromise workstations by establishing Windows Defender exclusion paths and delivering cryptocurrency miners like PrintMiner and XMRig.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 241d ago How this analysis works

Threat Graph

10 entities, 12 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

DCOM Launch
Malware
T1059.003 - Windows Command Shell
T1059.005 - Visual Basic
T1059 - Command and Scripting Interpreter

Malware (3)

CoinMiner
PrintMiner
XMRig

Affected Platform (2)

Windows
Windows Defender

Relationships

DCOM Launch targets Windows
DCOM Launch targets Windows Defender
Malware targets Windows
Malware targets Windows Defender
T1059.003 - Windows Command Shell targets Windows
T1059.003 - Windows Command Shell targets Windows Defender
T1059.005 - Visual Basic targets Windows
T1059.005 - Visual Basic targets Windows Defender
T1059 - Command and Scripting Interpreter targets Windows
T1059 - Command and Scripting Interpreter targets Windows Defender
CoinMiner related to PrintMiner
CoinMiner related to XMRig

Following this threat?

Track CoinMiner in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

USB-based CoinMiner Malware Targets South Korean Workstations

Article Content

More articles in this cluster (2)

Threat Graph

Following this threat?

Extracted Entities (11)

Attack Types (2)

Countries (1)

Malware (3)

MITRE ATT&CK (3)

Platforms (2)