Kingminer
- First seen
- 2018-01-01 00:00:00
- Malware type
- botnet, cryptominer, ddos
- Family
- Malware family
- Profile updated
- 2026-07-07 14:53:25
Targeted industries: energy-and-utilities financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Context
According to Sophis, the botnet has been active since 2018, initially, the botmasters operated DDoS tools and backdoors, but later moved on to cryptocurrency miners. They use a DGA to automatically change the hosting domains every week.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Kingminer_Auto (yara-rule)
Reports & references
- bleepingcomputer.com — Vulnerable Microsoft Sql Servers Targeted With Cobalt Strike (report)
- asec.ahnlab.com — 32572 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Kingminer (report)
- bitdefender.com — Bitdefender Pr Whitepaper Kingminer Creat4610 En En Genericuse (report)
- sophos.com — Sophos Labs Kingminer Botnet Report (report)
- Trend Micro — Uncovering A Kingminer Botnet Attack Using Trend Micro Managed X (report)
- news.sophos.com — Kingminer Report (report)