{"id":2358,"date":"2025-08-19T00:57:55","date_gmt":"2025-08-19T00:57:55","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2025\/08\/19\/usb-malware-campaign-spreads-cryptominer-worldwide\/"},"modified":"2025-08-19T00:57:55","modified_gmt":"2025-08-19T00:57:55","slug":"usb-malware-campaign-spreads-cryptominer-worldwide","status":"publish","type":"post","link":"http:\/\/ft365.org\/index.php\/2025\/08\/19\/usb-malware-campaign-spreads-cryptominer-worldwide\/","title":{"rendered":"USB Malware Campaign Spreads Cryptominer Worldwide"},"content":{"rendered":"
\n

A multi-stage malware attack delivered via infected USB devices has been identified, raising concerns over the persistence of cryptomining threats in 2025.<\/p>\n

Analysts from CyberProof\u2019s Managed Detection and Response (MDR) team discovered that the campaign used DLL search order hijacking and PowerShell to bypass security controls before attempting to install a cryptominer.<\/p>\n

The malware was linked to earlier Zephyr (XMRig) activity and was ultimately blocked during the final stage by endpoint detection and response (EDR) tools.<\/p>\n

The attack begins with a Visual Basic script concealed on USB drives. Once executed, the script initiates a chain of processes, including xcopy.exe, to move files into the Windows System32 directory. These files then enable the side-loading of a malicious DLL designed to download the cryptominer.<\/p>\n

CyberProof noted that the tactics closely resemble an international cryptocurrency mining scheme exposed by Azerbaijan\u2019s CERT in October 2024, known as \u201cUniversal Mining.\u201d<\/p>\n

The security firm\u2019s research traced the spread of the campaign through multiple intelligence sources and telemetry. Infections have been observed in the US, several European nations, Egypt, India, Kenya, Indonesia, Thailand, Vietnam, Malaysia and Australia.<\/p>\n

The wide geographical footprint highlights how removable media continue to be a persistent vector for malware distribution across both developed and developing regions.<\/p>\n

Read more on global cybercrime trends: Rethinking Resilience for the Age of AI-Driven Cybercrime\u00a0<\/em><\/p>\n

\u201cThe continued prevalence of cryptomining attacks originating from infected USB drives, even in mid-2025, serves as a powerful reminder of a fundamental security challenge,\u201d CyberProof said.<\/p>\n

To reduce exposure, the\u00a0report advises organizations to:<\/p>\n