HOMETHREATSCoinminer
APT / THREAT GROUP

Coinminer

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Coinminer is an unwanted malicious software which uses the victim's computational power (CPU and RAM mostly) to mine for coins (for example Monero or Zcash). The malware achieves persistence by adding one of the opensource miners on startup without the victim's consensus. Most sophisticated coin miners use timer settings or cap the CPU usage in order to remain stealthy.

Threat Analysis

Coinminer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.malwarebytes.com/threat-analysis/2018/01/a-coin-miner-with-a-heavens-gate/
→https://blog.malwarebytes.com/threat-analysis/2018/01/a-coin-miner-with-a-heavens-gate/amp/
→https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/
→https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html
→https://secrary.com/ReversingMalware/CoinMiner/

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

win.coinminerCoinminer

External Intelligence

Malpedia: win.coinminer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Coinminer