CuraSec

tag: Crypto-Mining · 3 items

Act Hugging Face malware campaign returns, hijacks GPUs and plants backdoors
2026-10-30 · BleepingComputer · source ↗ #supply-chain#ml-security#crypto-mining
  • Engineer — Act: Supply-chain compromise in a major ML registry qualifies as Act even without KEV: audit Hugging Face model pull history across pipelines, verify model hashes against known-good sources, and inspect GPU workloads for unauthorized mining processes. Also review any AI-agent-suggested GitHub starter kits for RAT payloads.
  • SOC/IR — Plan: No specific IOCs are provided to sweep for immediately, but the NetSupport RAT delivery via developer toolchains is a detection gap worth closing this quarter — build or tune detections for NetSupport execution originating from CI/CD runners and anomalous GPU utilization spikes on ML infrastructure.
  • Leader — Learn: ML supply chain attacks are maturing from nuisance to persistent threat; share with AI/ML team leads to prompt model provenance verification practices, and consider whether the risk register needs a dedicated ML-dependency entry alongside traditional software supply chain risk.
Act PoeLLM Malware Targets Exposed AI/LLM Servers for Cryptomining Botnet
2026-10-07 · The Hacker News · source ↗ #crypto-mining#llm-security#botnet
  • Engineer — Act: If you run any publicly exposed LLM or AI inference servers, audit them now for unauthorized crypto miner processes and verify no unauthenticated endpoints are reachable from the internet; 3,400+ confirmed infections indicates active, ongoing exploitation of this attack surface.
  • SOC/IR — Plan: Build or tune detections for anomalous CPU/GPU utilization and suspicious outbound connections from AI/ML servers tied to the Canto Incognito campaign; no IOCs are published yet, but the behavioral signature of crypto miner deployment on LLM infrastructure is worth adding to your hunt library.
  • Leader — Learn: AI and LLM infrastructure is now an active target for financially motivated botnets at scale — worth noting when reviewing security controls around AI deployments, but no immediate board or regulatory action required absent confirmed exposure.
Plan archived REVSTEALER Drops 4 Persistent Modules to Kill Defender and Mine Crypto
2026-09-06 · The Hacker News · source ↗ #windows-malware#defense-evasion#crypto-mining
  • Engineer — Learn: Elastic documents a novel persistence pattern where the initial stealer self-deletes but leaves behind four modules (ProManager, WinUpdate, SoftManager, +1) that disable Defender and Windows Update before mining crypto; no exploitation signals, but the defense-bypass design informs endpoint hardening strategy.
  • SOC/IR — Plan: Build or tune detections for the named module artifacts (ProManager, WinUpdate, SoftManager) and hunt for Windows Update / Defender service-disablement events paired with subsequent outbound crypto-mining traffic; check Elastic’s published research for YARA rules and ATT&CK mappings.
  • Leader — Skip